In which of the following access control models can a user not grant permissions to other users to see a copy of an object marked as secret that he has received, unless they have the appropriate…

Discretionary Access Control (DAC) allows resource owners to grant permissions to other users at their own discretion, meaning a user could share a secret object with others if they chose to.

An Access Control List (ACL) is an implementation mechanism, not a security model, and does not inherently prevent object owners from modifying or sharing permissions.

In Mandatory Access Control (MAC), the operating system or security kernel makes all access decisions based on security labels assigned to both subjects (users) and objects (files, data). A user who receives a 'secret' labeled object cannot grant access to others unless those individuals already hold the appropriate clearance level, because access rights are controlled by the system policy, not the user. This non-discretionary enforcement is the defining characteristic of MAC and is commonly implemented in government and military classification systems.

Role Based Access Control (RBAC) grants permissions based on assigned job roles rather than security classification labels, and does not enforce clearance-level restrictions on object sharing.