A defense contractor requires that access to files be governed strictly by security clearance levels and information classification labels. Users, regardless of their job role or ownership of a file, cannot change these labels or grant access to others. Only the system enforces access decisions based on the sensitivity of the resource and the clearance of the subject. Which access control model does this describe?