A user sends an e-mail request asking for read-only access to files that are not considered sensitive. A Discretionary Access Control (DAC) methodology is in place. Which is the MOST suitable approach

Under DAC, access control decisions are at the discretion of the data owner, not the administrator or manager. The administrator's role is to facilitate access requests by obtaining approval from the owner of the resource, who retains ultimate authority over who can access their data. Even for non-sensitive files, bypassing the data owner's approval violates the DAC model's foundational principle.

Manager approval is associated with role-based or organizational approval workflows, not the DAC model, where the data owner-not the user's manager-controls access rights to specific resources.

Directly granting access without data owner approval violates the DAC principle, which explicitly reserves access-granting authority for the resource owner, regardless of the sensitivity level of the files.

The administrator independently assessing and deciding on access contradicts the DAC model; in DAC, the administrator acts on behalf of or with authorization from the data owner, not on their own judgment.