A department manager would like to choose an access control model in which the owner of a resource decides who may modify permissions on that resource. Which model fits that scenario?

Answer: Discretionary access control (DAC)

Explanation: Discretionary access control is the control system that is imposed over the information system. The information systems contains different objects and subjects that gets the permission to do the operations.

The operation which the components can do are sharing the data to other object or subjects, privilege providence, change in the rules for the access, security entities getting changed etc.