A defense contractor operates a network where the operating system enforces access decisions based on security labels assigned to both users and files. A user with a SECRET clearance attempts to open a document labeled TOP SECRET, and the system denies access. Even the file's creator cannot change the classification label or grant another user access to it — only a central security administrator can adjust labels. Which access control model is being enforced in this environment?