The main types of access controls are: 1) Role based access control (RBAC). Permissions are based on the role of a user a group. Instance and custom roles are two types of RBAC. 2) Attribute-based access control. Permissions are based on an object, user and environment. An object is a type of document a user wants access to. A user attribute is a department title or level of security clearance. An action attribute is the ability to edit or delete. 3) Discretionary-based access control. Permissions are set according to the administator, who determines access based on the identity of the user or group. 4) Mandatory-based access control. Permissions are set according to the system administator, who determines access based on the sensitivity of the information.