5 Types of Access Control Models & Methods Explained

 

 

When it comes to controlling access to your property, it is challenging to find an access control system method that benefits everybody. Different access control models come with a variety of features and technology. The usefulness of any of these models depends on your unique property and the levels of access that you wish to manage.

This guide helps you choose the best access control system model. First, we explain access control. Next, we review the five main types of access control. Lastly, we explore the best access control model.

This post covers:

• What is access control?
• What are access control models?
• 5 access control models and methods
• Which is the most popular access control model?

 

What is access control?

Access control maintains building security by strategically controlling who can access your property and when. It can be as simple as a door with a lock on it or as complex as a video intercom, biometric eyeball scanners, and a metal detector. Access control allows you to manage who enters your property and at what time.

 

What are access control models?

Access control models are distinguished by the user permissions they allow, and the methods we cover in this post all feature electronic hardware that uses technology to control access to a property.

Some types of security access control are more strict than others and are more suitable for commercial properties and businesses. Other methods are better suited for buildings that receive a high volume of visitors, and some basic control models are better for buildings with low traffic.

While looking elsewhere on the web, you may learn about different access control methods or alternate definitions for the models we list below. There are two categories of access models: models that benefit physical properties and models used to set software permissions for accessing digital files.

While some interesting connections are to be made here, they actually have very little to do with each other. This is especially true when finding the right physical access control system for your property.

 

 

5 access control models and methods

There are five types of access control methods that you will commonly see across a variety of properties. Keep in mind that some models are exclusively used for commercial properties.

The five main access control models are:

1. Discretionary access control (DAC)
2. Mandatory access control (MAC)
3. Role-based access control (RBAC)
4. Rule-based access control (RuBAC)
5. Attirbute-based access control (ABAC)

 

1. Discretionary access control (DAC)

The discretionary access control model is one of the least restrictive access models. It allows multiple administrators to control access to a property, which is especially convenient for residential properties or businesses with multiple managers.

One advantage of DAC access control is its straightforward nature, which makes it easy to assign users access.

However, the downside is that this model can lead to confusion if multiple administrators don’t communicate properly about who does and doesn’t have access.

 

2. Mandatory access control (MAC)

Mandatory access control stands as a complete alternative to discretionary access control. This access control design is best for businesses that emphasize security and confidentiality. As a result, this model features only one system administrator.

The system administrator cannot be overridden or bypassed, and they determine who has access to a property. As such, government facilities primarily use mandatory access models because of the singular security system administrator option.

 

3. Role-based access control (RBAC)

The role-based model, also known as non-discretionary access control, assigns every user a specific role with unique access permissions. System administrators can assign user roles and manage access for each role. This type of access control model benefits both residential and commercial properties.

For residential properties, residents tend to move in and out of a building depending on the terms of their lease. This model makes it easy to give new residents access permissions while revoking access for prior tenants.

Different access levels can be granted for commercial properties based on an employee’s job title. A server room, for example, can be restricted to computer engineers. If a computer engineer switches over to a different team, their access to the server room can be easily revoked. There are only positives with a role-based access control system unless your property would benefit from specific criteria that define the other three access models.

 

Learn how ButterflyMX works:

 

4. Rule-based access control (RuBAC)

Rule-based access control features an algorithm that changes a user’s access permissions based on qualifying factors, such as the time of day.

An example of rule-based access control is adjusting access permissions for an amenity such as a pool or gym only open during daylight hours.

Another example is an office accessible only to certain users during business hours. In this scenario, a manager with different permissions can still access the office when others can’t.

Another high-security use for this model is the ability to program a role-based access control system to lock down specific areas of a building if a security compromise is detected at a main entrance. Of course, the specifics of this feature vary from system to system.

 

5. Attribute-based access control (ABAC)

Attribute-based access control takes a more flexible and dynamic approach than the other models. Instead of assigning permissions based solely on a user’s role, ABAC evaluates multiple attributes—such as the user’s job title, department, time of day, location, or security clearance—to decide whether to grant access.

For example, a maintenance worker might have access to mechanical rooms during business hours but not after 6 p.m., or a contractor might have access to specific floors only on their assigned project dates. ABAC is particularly useful for complex properties with many access scenarios that don’t fit neatly into predefined roles.

The downside is that ABAC can be more complex to set up and manage than simpler models because it requires defining and monitoring many attributes. However, for properties with highly variable access needs, ABAC offers superior granularity and control.

 

Which is the best access control model?

The best access control model depends on your property’s specific needs. User-friendliness and accessibility are key concerns for most people.

For most residential and standard commercial properties, role-based access control (RBAC) is the most practical choice because it’s easy to manage and scales well as tenants or staff change. However, if your property has complex or time-sensitive access scenarios, such as amenities with restricted hours, contractors with limited-date access, or multiple security zones, attribute-based access control (ABAC) or rule-based access control (RuBAC) may serve you better.

Mandatory access control (MAC) is typically reserved for high-security facilities like government buildings or data centers. Discretionary access control (DAC) works best in smaller properties where multiple managers need flexibility to adjust permissions independently.

Get your free quote!

Fill in the form below, and we'll email you right back.

Want a free quote?

Fill in the form below, and we'll email you right back.