Discretionary access control allows resource owners to determine access permissions, while mandatory access control enforces access based on predefined security labels or levels, set by a central authority. In discretionary control, owners have flexibility; in mandatory control, access is determined by security classifications.