With discretionary access control (DAC) policies, authorization to perform operations on an object is controlled by the object’s owner or by principals whose authority can be traced back to that owner. The goals of an institution, however, might not align with those of any individual. So for systems intended to support institutions, a more natural basis for authorization is rules set by the ins...
