Which of the following access control models uses a predefined set of access privileges for an object of a system?

Discretionary Access Control (DAC) allows resource owners to set access permissions at their own discretion, making it the opposite of a system-predefined access model.

Mandatory Access Control uses system-enforced security labels assigned to both subjects and objects, and the operating system makes all access decisions based on these predefined classification levels without allowing users to modify them. The policy is set administratively and applied uniformly, meaning no individual user can grant or revoke access outside the defined label hierarchy. This predefined, non-discretionary policy model is the defining characteristic that distinguishes MAC from other access control approaches.

Policy Access Control is not a recognized standard access control model in information security frameworks such as those defined by NIST.

Role-Based Access Control (RBAC) assigns permissions based on organizational job roles rather than on predefined security classification labels attached to system objects.