access to data?

In discretionary access control, who/what has delegation authority to grant
access to data?

A.
A user

B.
A security officer

C.
A security policy

D.
An owner