Access control where a central authority defines access policies based on security classifications. Users cannot override these policies. Common in government systems.