Access control

The theoretical baseline is Lampson's access matrix (1971): subjects as rows, objects as columns, and a set of rights in each cell. Real systems never store the matrix; they slice it either by column, giving access control lists attached to objects (Unix mode bits, POSIX ACLs, NTFS DACLs, S3 bucket policies), or by row, giving capabilities held by subjects (file descriptors, object-capability references, bearer tokens). The 1972 Anderson report added the reference monitor concept: the enforcing component must be invoked on every access (complete mediation), be tamper-proof, and be small enough to verify. Those three properties are still the right yardstick for any enforcement point.

Policy models sit on top. Discretionary access control (DAC) lets the owner of an object grant rights, as with chmod. Mandatory access control (MAC) enforces system-wide labels the owner cannot override; Bell-LaPadula ("no read up, no write down") protects confidentiality and Biba protects integrity, and SELinux and AppArmor bring MAC to Linux. Role-based access control (ANSI INCITS 359-2004) routes permissions through roles, attribute-based access control (NIST SP 800-162) evaluates rules over subject, object, action and environment attributes, and relationship-based access control, popularised by Google's Zanzibar paper (2019), derives rights from a graph of relations such as owner, member and parent folder. Production systems usually combine several.

Architecturally, the XACML vocabulary is standard: a policy enforcement point (PEP) intercepts the request, a policy decision point (PDP) evaluates it, a policy information point (PIP) supplies attributes, and a policy administration point (PAP) manages rules. NIST SP 800-207 reuses the PEP/PDP split for Zero Trust. Externalised engines such as Open Policy Agent (Rego) or Cedar keep policy out of application code. Sound defaults are deny-by-default, enforcement on the server for every request and every object, fail-closed when the PDP is unreachable, and logging of both allow and deny decisions.

Failures are common: Broken Access Control is A01 in both OWASP Top 10:2021 and Top 10:2025, covering insecure direct object references, missing function-level checks, forced browsing, tampered tokens and, from 2025, SSRF. The confused deputy problem (Hardy, 1988) shows how a privileged program can be tricked into spending its authority on behalf of a caller; time-of-check-to-time-of-use gaps and cached decisions that survive revocation are other classic faults. Access control is the per-request mechanism; access management is the lifecycle of granting, recertifying and removing rights. ISO/IEC 27001:2022 covers both in Annex A 5.15-5.18, with 7.2 for physical entry and 8.3 for information access restriction.