DRAG DROP Match the name of access control model with its associated restriction. Drag each access control model to its appropriate restriction access on the right.

The matching is based on the defining characteristics of each access control model.

• Mandatory Access Control (MAC) is a non-discretionary model where a central authority defines access policies based on security labels (e.g., clearance levels). The end user has no authority to change these system-enforced rules.
• Discretionary Access Control (DAC) allows the owner (subject) of a resource (object) to determine the access permissions for other users at their discretion.
• Role Based Access Control (RBAC) simplifies administration by grouping permissions into roles that correspond to job functions. Users are assigned roles, thereby acquiring the permissions associated with those duties.
• Rule Based Access Control uses specific rules or policies that evaluate conditions (criteria) to grant or deny access. A sophisticated implementation of this model can dynamically assign roles to a subject if certain criteria, set by an administrator (custodian), are met.

For MAC and DAC: Saltzer, J. H., & Schroeder, M. D. (1975). The Protection of Information in Computer Systems. Communications of the ACM, 17(7), 38-41. (In Section I.A.3, "Design Principles," the document contrasts centrally-managed, mandatory controls with schemes where individual users control access to their own data, which is the core of the MAC vs. DAC distinction). DOI: https://doi.org/10.1145/361011.361062

For RBAC: Ferraiolo, D. F., & Kuhn, D. R. (1992). Role-Based Access Control. Proceedings of the 15th National Computer Security Conference, (pp. 554-563). (This foundational paper defines RBAC as a method of restricting system access to authorized users based on their roles within an organization. Section 3, "The Model," explicitly links roles to job functions). Available via NIST: https://csrc.nist.gov/csrc/media/projects/role-based-access-control/documents/ferraiolo-kuhn-92.pdf

For Rule-Based/Attribute-Based Control: Hu, V. C., Ferraiolo, D., Kuhn, R., Schnitzer, A., Sandlin, K., Miller, R., & Scarfone, K. (2014). Guide to Attribute Based Access Control (ABAC) Definition and Considerations (NIST Special Publication 800-162). National Institute of Standards and Technology. (Section 2.1 defines ABAC, a modern form of rule-based control, as a model where rules evaluate attributes—or criteria—to make access decisions. This can include dynamically managing a subject's privileges or role memberships based on these attributes). DOI: https://doi.org/10.6028/NIST.SP.800-162