Examines all possible system states to maintain proper relationships between objects and subjects.
Deals mainly with confidentiality issues and focuses on information flow.
Organizes tables of subjects and objects to show what actions each subject can take on each object.
Prevents actions at one level from altering the state visible to another level.
Controls information flows between two versions of the same object.