Question
What is authorization and what are the possible access types?
Answer
Authorization decides which actions a subject may perform on an object; the access types are Create, Read, Update, Delete, Execute, or None.
Authorization = Managing permissions of subjects (users/services) accessing objects (resources)
Formula: permission = access(subject, object)
Access types (CRUD + Execute):
- Create - Add new resources
- Read - View resources
- Update - Modify existing resources
- Delete - Remove resources
- Execute - Run operations/functions
- None - No access allowed
Authorization indicates the actions a subject may perform on an object.
Note saved — thanks!
Question
What are the two main access control methods and policies?
Answer
Two methods — DAC (the resource owner grants access) vs MAC (the system enforces access from fixed security labels) — and two policies — Open (allow unless denied) vs Closed (deny unless allowed).
The method answers who decides who gets access; the policy answers what the default is when nothing explicit says yes or no.
Methods — who controls access:
| Method | Who decides | Trade-off |
|---|---|---|
| Discretionary Access Control (DAC) | The owner of each resource grants/revokes access (e.g. Unix file permissions, "share this doc") | Flexible and convenient, but an owner can leak access — no central guarantee |
| Mandatory Access Control (MAC) | The system enforces a central policy from security labels (e.g. Secret/Top-Secret); even the owner can't override it | Very strict and leak-resistant, but rigid — used in military/government |
Policies — the default answer:
| Policy | Default | You then... | Risk |
|---|---|---|---|
| Open Policy | Allow all | explicitly deny specific access | Anything you forget to deny stays open — dangerous |
| Closed Policy | Deny all | explicitly grant specific access | Anything you forget to grant is simply blocked — fails safe |
Best practice: Use a Closed Policy (deny by default, grant only what's explicitly needed). This is the principle of least privilege: a forgotten rule then fails closed (blocked) instead of open (exposed).
Go deeper:
Discretionary access control (Wikipedia) — how owner-granted permissions (e.g. Unix file modes) work and where they can leak access.- Mandatory access control (Wikipedia) — label-based enforcement the owner can't override, as used in military systems and SELinux.
Note saved — thanks!