A security professional is asked to provide a solution that restricts a bank teller to only perform a savings deposit transaction but allows a supervisor to perform corrections after the transaction.

Rule-based access control applies access decisions based on predefined system rules (such as time-of-day or IP restrictions), not on a user's organizational job function or title.

Mandatory Access Control (MAC), where access is determined by the system using labels and classifications, is typically used in government/military contexts and does not align permissions to job roles like teller or supervisor.

Role-Based Access Control (RBAC) assigns permissions based on a user's job role rather than individual identity. In this scenario, the 'bank teller' role is granted only deposit transaction rights, while the 'supervisor' role is granted additional correction privileges - perfectly matching RBAC's design principle of aligning access rights to organizational functions.

Attribute-Based or sensitivity-based access control restricts access according to the classification level of data (e.g., confidential, public), not according to what transactional actions a specific job role is permitted to perform.