An analyst at a defense contractor is granted read access to a document labeled 'Secret' because her clearance and need-to-know match. She wants to email the file to a colleague who has only a 'Confidential' clearance. The system blocks her attempt and prevents her from changing the file's label. Which access control model is enforcing this restriction?