A defense contractor requires that every file and user be assigned a sensitivity label (e.g., Confidential, Secret, Top Secret), and the operating system itself enforces that a user can only open a file if their clearance dominates the file's label. Individual data owners are NOT permitted to grant other users access to their own files. Which access control model is being described?