Field notebook · source record
AC-3(4)
Access ControlDiscretionary Access Control
The statement below is source material, not a generated control summary.
Source statement
Enforce {{ insert: param, ac-3.4_prm_1 }} over the set of covered subjects and objects specified in the policy, and where the policy specifies that a subject that has been granted access to information can do one or more of the following: Pass the information to any other subjects or objects; Grant its privileges to other subjects; Change security attributes on subjects, objects, the system, or the system’s components; Choose the security attributes to be associated with newly created or revised objects; or Change the rules governing access control.
Guidance
When discretionary access control policies are implemented, subjects are not constrained with regard to what actions they can take with information for which they have already been granted access. Thus, subjects that have been granted access to information are not prevented from passing the information to other subjects or objects (i.e., subjects have the discretion to pass). Discretionary access control can operate in conjunction with mandatory access control as described in [AC-3(3)](#ac-3.3) and [AC-3(15)](#ac-3.15) . A subject that is constrained in its operation by mandatory access control policies can still operate under the less rigorous constraints of discretionary access control. Therefore, while [AC-3(3)](#ac-3.3) imposes constraints that prevent a subject from passing information to another subject operating at a different impact or classification level, [AC-3(4)](#ac-3.4) permits the subject to pass the information to any subject at the same impact or classification level. The policy is bounded by the system. Once the information is passed outside of system control, additional means may be required to ensure that the constraints remain in effect. While traditional definitions of discretionary access control require identity-based access control, that limitation is not required for this particular use of discretionary access control.
Organization-defined parameters
Organization-defined · unresolvedCatalog reference only. No project value has been assigned or evaluated here.
- ac-3.4_prm_1
organization-defined discretionary access control policy
- ac-03.04_odp.01
discretionary access control policy
Source guidance- discretionary access control policy enforced over the set of covered subjects is defined;
- ac-03.04_odp.02
discretionary access control policy
Source guidance- discretionary access control policy enforced over the set of covered objects is defined;
Assessment reference context
Retained, not activated.1 source assessment records and 7 objective nodes are available as reference context. This surface runs none of them.
ac-3.4_objAC-03(04)7 objective nodes
- {{ insert: param, ac-03.04_odp.01 }} is enforced over the set of covered subjects specified in the policy;
- {{ insert: param, ac-03.04_odp.02 }} is enforced over the set of covered objects specified in the policy;
- {{ insert: param, ac-03.04_odp.01 }} and {{ insert: param, ac-03.04_odp.02 }} are enforced where the policy specifies that a subject that has been granted access to information can pass the information to any other subjects or objects;
- {{ insert: param, ac-03.04_odp.01 }} and {{ insert: param, ac-03.04_odp.02 }} are enforced where the policy specifies that a subject that has been granted access to information can grant its privileges to other subjects;
- {{ insert: param, ac-03.04_odp.01 }} and {{ insert: param, ac-03.04_odp.02 }} are enforced where the policy specifies that a subject that has been granted access to information can change security attributes on subjects, objects, the system, or the system’s components;
- {{ insert: param, ac-03.04_odp.01 }} and {{ insert: param, ac-03.04_odp.02 }} are enforced where the policy specifies that a subject that has been granted access to information can choose the security attributes to be associated with newly created or revised objects;
- {{ insert: param, ac-03.04_odp.01 }} and {{ insert: param, ac-03.04_odp.02 }} are enforced where the policy specifies that a subject that has been granted access to information can change the rules governing access control.
Reference method and authority
- InputExact release, source digest, control ID, and cited source fields
- Agent taskPrepare a bounded evidence request or test-plan draft
- Fail closedAbstain when source, scope, or assessment identity is missing
- Human acceptanceA named reviewer decides whether evidence supports the conclusion