For a discretionary access control to be effective, it must:

A.
operate within the context of mandatory access controls.

B.
operate independently of mandatory access controls.

C.
enable users to override mandatory access controls when necessary.

D.
be specifically permitted by the security policy.

Explanation:
Mandatory access controls are prohibitive; anything that is not expressly permitted is forbidden. Only within this
context do discretionary controls operate, prohibiting still more access with the same exclusionary principle.
When systems enforce mandatory access control policies, they must distinguish between these and the
mandatory access policies that offer more flexibility. Discretionary controls do not override access controls and
they do not have to be permitted in the security policy to be effective.