Most city staff access systems by job role, a few apps must also consider time-of-day and building location, and a small set of highly labeled records require system-enforced labels users cannot override. Which access-control mix best matches that need?

Different municipal data classes need different access-control models. Role-based access control (RBAC) fits most staff who receive permissions from job roles (clerk, engineer, analyst). Attribute-based access control (ABAC) adds contextual rules—time of day, building location, device posture—for apps that must tighten or relax access based on those attributes. Mandatory access control (MAC) applies system-enforced labels to highly sensitive or classified-style records so users cannot unilaterally retag or share downward contrary to policy. Combining RBAC for routine access, ABAC for context-sensitive apps, and MAC for labeled intelligence extracts matches a city that has ordinary business systems plus a small set of strictly labeled data.

Using discretionary access control alone for every system, including labeled intelligence extracts, lets object owners make sharing decisions that may violate mandatory label policy. Removing all models in favor of hallway verbal approval is informal and unauditable. Granting unrestricted write access to every employee and auditing later inverts preventative control into after-the-fact hope.

Exam caveat: know the distinctions—DAC is owner-discretionary, RBAC is role-centric, ABAC is attribute/policy-centric, MAC is label-enforced and not user-overridable. Real deployments often layer these rather than picking only one globally.

Operational check: map city systems to the intended model, ensure labeled repositories enforce MAC-style controls that staff cannot bypass via share dialogs, and verify time/location ABAC policies actually deny access outside approved windows and buildings.