In an access control system, what must be done each time a subject attempts to access an object?

In an access control system, each time a subject attempts to access an object, it is essential to check access rights against a policy table. This process involves verifying whether the subject has the necessary permissions defined in the access control policy to interact with the requested object.

The policy table contains rules that outline who has access to what resources and under what conditions. By referencing this table, the system ensures that access is granted only to authorized users, thus maintaining security. This check is fundamental to ensuring that users are only able to perform actions they are explicitly permitted to do, consistent with the principle of least privilege.

The other choices do not accurately describe the ongoing requirements for access control. Logging in again would be cumbersome and inefficient for ongoing access. Conducting a review to confirm user needs is not practical for every single access attempt, as it would introduce delays and potentially hinder productivity. Revalidating authentication with an external server may be necessary in certain contexts but is not a standard process that occurs for every access attempt in a typical access control mechanism. The primary requirement is to verify permissions against the established policy, which is accurately represented by checking access rights against a policy table.