DAC (Discretionary Access Control): In this model, the object owner creates the file or resource and has the discretion to assign access rights (permissions) to other users, usually via Access Control Lists (ACLs).

MAC (Mandatory Access Control): The system (specifically the Operating System or Trusted Computing Base) enforces access based on immutable security labels (e.g., Top Secret) assigned to subjects and objects. Users cannot override these policies.

RBAC (Role-Based Access Control): Access permissions are associated with specific job functions or roles. Users acquire permissions only by being assigned to a role, rather than directly.

ABAC (Attribute-Based Access Control): Access is granted dynamically based on policies evaluating attributes of the subject (e.g., seniority), the object, and the environment (context).

Hu, V. C., Ferraiolo, D. F., & Kuhn, D. R. (2006). NIST Special Publication 800-192: Assessment of Access Control Systems. National Institute of Standards and Technology.

DAC: Page 8, Section 2.1 ("...controls access based on the identity of the user and the access rules... The owner of the object specifies the subjects...").

MAC: Page 9, Section 2.2 ("...access control decisions are made by a central authority, not by the individual owner...").

RBAC: Page 11, Section 2.3 ("Access decisions are based on the roles that individual users have...").

Hu, V. C., et al. (2014). NIST Special Publication 800-162: Guide to Attribute Based Access Control (ABAC) Definition and Considerations. National Institute of Standards and Technology.

ABAC: Page vii, Executive Summary ("ABAC... grants access rights... through the use of policies that combine attributes together.").

Sandhu, R. S., et al. (1996). "Role-Based Access Control Models." IEEE Computer, 29(2), 38-47. https://doi.org/10.1109/2.485845 (Foundational academic source for RBAC mechanics).