Which of the following access control types would give a system administrator the ability to assign access according to least privilege?

Role-based access control assigns permissions through predefined role memberships rather than direct individual assignment, limiting the administrator's ability to grant granular least-privilege access outside of the defined role boundaries.

Rule-based access control governs access through system-defined conditions such as time of day or source IP, not through administrator-driven individual user assignments.

Discretionary Access Control allows the system administrator to use their own discretion to assign specific access rights directly to individual users or resources, making it possible to tailor permissions precisely to what each user requires and nothing more. Unlike role-based or mandatory models, DAC puts the access assignment decision in the administrator's hands rather than a fixed policy or role structure. This direct, granular control is what enables a least-privilege approach under DAC.

Mandatory Access Control enforces access based on security classification labels dictated by system policy, removing discretionary control from the administrator entirely and preventing per-user least-privilege tuning.