A cloud administrator is reviewing the authentication and authorization mechanism implemented within the cloud environment. Upon review, the administrator discovers the sales group is part of the…

Discretionary access control (DAC) delegates access decisions to individual resource owners rather than to centrally defined roles, which does not match the group-based inheritance model described in the scenario.

Attribute-based access control (ABAC) makes access decisions by evaluating dynamic attributes such as department, time of day, or location against policies - the issue here is static group nesting within a role structure, not attribute policy logic.

Mandatory access control (MAC) enforces access through system-assigned security labels and clearance levels, a model used primarily in classified government or military environments and not applicable to a commercial cloud role/group scenario.

Role-based access control (RBAC) grants permissions through role and group membership, so placing the sales group inside the finance group causes every sales team member to inherit all finance role entitlements including access to the financial application. Correcting the RBAC configuration by removing the sales group from the finance group enforces least-privilege without altering the SSO implementation, since SSO handles authentication while RBAC governs what authenticated users are authorized to access. This group nesting issue is a classic RBAC misconfiguration that violates the principle of separation of duties.