MAC enforces access based on labels assigned to subjects (users/processes) and objects (files/data) — the OS/security policy controls access, not the owner. Used in government/military.
MAC vs DAC vs RBAC: MAC = system decides (most secure), DAC = owner decides (most flexible), RBAC = role decides (most practical). SELinux and AppArmor implement MAC on Linux. MAC prevents Trojan horse attacks — even malware running as you can't violate MAC policies.