What Is Access Control?

Access control decides who may do what to which resource. It is the mechanism nearly every other security property depends on, and the place where most organisations carry their largest quiet exposure — not through a broken control, but through permissions granted years ago and never revisited.

The question worth asking is rarely whether access control exists. It is whether anyone can describe what a given account can actually reach.

---

The models, and where each fits

Discretionary control lets the owner of a resource decide who may use it. It is flexible and it produces sprawl, because thousands of individual decisions are made by people optimising for getting work done.

Mandatory control enforces system-wide policy that users cannot override, typically by classification level. It is rigid, and it suits environments where the classification is genuinely the organising principle.

Role-based control assigns permissions to roles and people to roles. It is the dominant enterprise model because it scales administratively, and its characteristic failure is role proliferation — hundreds of near-identical roles created because none quite fitted.

Attribute-based control evaluates policy against attributes of the user, resource, action and context. It is the most expressive and the most complex, and it underpins the conditional access decisions modern identity platforms make.

---

Accumulation is the practical problem

Permissions attach to people as they move through an organisation and are almost never removed. Someone who has worked in three departments holds the access of all three, and the resulting account is more privileged than any role the organisation defined.

This is privilege creep, and it is why access review exists. It is also why reviews frequently fail: a manager asked to approve a list of two hundred entitlements with opaque names will approve all of them.

---

Roles versus attributes in practice

Role-based control is administratively tidy and struggles with nuance. The moment access depends on context — this user, for this patient, during this shift, from this location — a role either becomes too broad or multiplies into near-identical variants.

Attribute-based policy handles that directly by evaluating conditions at the point of access, which is how modern conditional access works. The cost is that policy becomes harder to reason about: answering “who can reach this?” requires evaluating rules rather than reading a membership list.

Most organisations end up with both — roles carrying the baseline grant and attributes refining it — which is workable provided someone can still answer the access question when an auditor asks.

---

Making reviews mean something

The failure of access review is well documented and entirely predictable: a reviewer receives hundreds of entitlements with technical names, no indication of what they permit, and a deadline. Approving everything is the rational response.

What changes the outcome is reducing what is reviewed and improving how it is presented. Review only what carries risk rather than everything. Describe entitlements in business terms. Highlight what changed since last time, so the reviewer considers a short list rather than re-approving a long one. And show last use, because an entitlement unused in a year is an easy decision.

Where to start

Pick someone who has changed roles twice and list everything their account can reach. That single example is normally enough to establish whether your mover process works, and it usually establishes that it does not.

See least privilege and identity governance. GuardsArm runs security risk assessments.