Which governance mechanism best enforces least privilege by assigning permissions to roles rather than individuals?

• A. Mandatory Access Control
• B. Discretionary Access Control
• C. Role-Based Access Control
• D. Attribute-Based Access Control

Answer: (C)

Assigning permissions to roles and granting users those roles is the mechanism that enforces least privilege most directly. In Role-Based Access Control, each role embodies a minimal set of permissions needed for a specific job function. Users receive access by being assigned appropriate roles, not by inheriting permissions on an individual basis. This setup makes it easy to maintain least privilege: you define narrow roles, assign users to the right roles, and adjust access by changing role membership rather than hand-tuning many individual permissions. If a user changes roles, you simply reassign the role rather than reconfiguring permissions for that person.

Other schemes don’t match this approach as cleanly. Mandatory Access Control relies on fixed, system-wide labels and clearance levels rather than role-based grouping of duties. Discretionary Access Control centers on permissions set by resource owners for individual users, which can lead to inconsistent or scattered permission management. Attribute-Based Access Control uses policies based on multiple attributes, offering fine-grained control but not the specific pattern of managing permissions through roles.