So I've been reading up on MAC vs DAC vs RBAC and there is something which I do not understand. Everywhere you read, it tells you that these types are different (disjoint) but isn't RBAC just a type (implementation) of MAC?
From what I gather, MAC is a generic control policy in which the administrator manages all access rights. In RBAC, rights are assigned to roles but ultimately roles are still managed by the administrator right? The admin decides which user has which role and he is also the one which can change permission for all roles so ultimately the administrator is still the one managing all access rights, correct?
Also I've watched this video on YouTube Implementing MAC Example, and this model worked as such: data was classified into categories according to its sensitivity (i.e. top secret, secret, confidential etc) and the company was divided into departments. The account control was implemented as a set of labels L = (sensitivity level, department) which meant that users from that department have rights on files of that sensitivity level. Very basic example, I know, but I don't understand how this is different from RBAC. The department of a user is basically his role and the labels show what rights each of the departments has. Honestly if I were to be asked "what type of account control was presented in the video" I would answer RBAC but the video claims it presents MAC.
Can someone shed some light on precisely what differs between the two and why one isn't just a subcategory of the other?
Thanks in advance.