Access Control Models

The soccer league's registrar and an assistant are the only people who can see every record it holds: each player's birth date and medical note, each family's address and payments. Everyone else sees a slice. Deciding how big each slice is, and who decides, is access control.

The registration site doesn't list its 250 or so volunteers one by one. It gives each account a role, and the role carries the access.

A parent volunteers in March to run the snack schedule. Which row should the new account get?

The new volunteer should get the team parent row, since a snack schedule needs names and phone numbers and nothing more. Giving the account the coach role because it was the nearest fit would open every medical note on the team to someone who has no use for them.

Coaches open medical notes at the field, on phones and tablets. The league adds a rule: medical notes open only on a device the league has registered to that coach. A coach's account on a registered tablet gets the note. The same account signing in from a computer at a library is refused, even though the coach role allows the note, so a stolen password alone doesn't reach it. A layer of rules like this one is called rule-based, RuBAC for short.

Some objects belong to a person rather than the league. A team parent who uploads the season's game photos to the league's drive owns that album. The team parent gives the team's families permission to view it and the assistant coach permission to add photos, and leaves everyone else out. The league's drive administrator can still overrule that choice, for instance to take down a photo posted by mistake.

A soccer league has no use for the fourth model, which comes from government and the military. There an administrator, not the owner, gives every person a clearance and every document a level, and no user or owner can change either.

The best-known set of those fixed rules was written for the U.S. Air Force in 1973 by two researchers at MITRE, David Bell and Leonard LaPadula, and carries their names.

With the levels Confidential, Secret, and Top Secret, a person cleared for Secret can read Confidential and Secret documents and not Top Secret ones. Writing runs the other way. A clerk cleared only for Confidential may add a report to a Secret file, which puts what the clerk knows only in front of readers cleared higher, but a person cleared for Secret may not write into a Confidential document, where something Secret could end up in front of readers with a lower clearance.

Desjardins is a large cooperative bank, with its head office in Lévis, Quebec.

Police in Laval, investigating something else, told Desjardins in May 2019 that one of its employees had been copying members' personal information for more than two years. The employee worked in marketing. Desjardins kept member data in two large databases, and marketing staff who were allowed into them routinely copied pieces onto a shared drive the marketing team used. The employee had no authorization for the banking database, but the shared drive held his colleagues' copies of it. He gathered them with scripts, saved them to his work computer, and carried them out on USB drives.

Compare what the employee's job called for with what the shared drive handed him. What should have been different?

The drive should have held only what each marketing task needed, open only to the people doing that task, and the copies should have been deleted when the task was done. Instead it gathered names, birth dates, social insurance numbers, and transaction histories in one place that a whole department could read. Desjardins controlled who could open the databases and never extended that control to the copies. The principle of least privilege names the rule the drive broke.

The copies covered all 4.2 million of Desjardins's individual members, by its own count. Canada's privacy commissioner put the number of people affected at close to 9.7 million, counting old, inactive files, some inactive for decades, that Desjardins had no schedule for destroying. In December 2020 the federal commissioner found that Desjardins had broken federal privacy law, including its rules on safeguards and on how long data may be kept, and Quebec's access to information commission found it had broken Quebec's privacy law for businesses. In 2022 a Quebec court approved a class-action settlement of up to about 200 million Canadian dollars. In June 2024 Quebec police arrested the former employee and four others on charges including fraud and identity theft, and in mid-May 2026 the case still had no trial date.