A defense contractor operates a system where the operating system itself enforces access based on security labels assigned to both users and files. A user with a 'Secret' clearance cannot open a file labeled 'Top Secret', and even the file's creator cannot change these label-based restrictions. Which access control model is in use?