A government agency stores documents that carry classification labels such as 'Confidential', 'Secret', and 'Top Secret'. Each user is assigned a clearance level, and the operating system itself enforces the rule that a user may only open a document if their clearance is equal to or higher than the document's label. Individual document owners cannot override this rule to share files with lower-cleared colleagues. Which access control model is being used?