Based on which statement does the discretionary access control security model grant or restrict access ?

Granting access at the discretion of the system administrator implies centralized administrative control, which contradicts the DAC principle where the object owner - not the admin - holds that discretion.

DAC is defined by the principle that the owner of an object, such as a file or directory, has the discretion to specify who can access it and what operations they can perform. This is typified by Unix/Linux file permissions where the file creator controls read, write, and execute rights for owner, group, and others. The key distinguishing factor is that control is delegated to the individual resource owner rather than enforced centrally.

A security policy centrally defined and enforced by the system administrator describes Mandatory Access Control (MAC), where the OS enforces labels and classifications that individual users cannot override.

Basing access on a user's role within an organization describes Role-Based Access Control (RBAC), a distinct model where permissions are assigned to roles rather than controlled by resource owners.