A company configures its access control system so that all employees can log into the payroll application only between 8:00 a.m. and 6:00 p.m. on weekdays. Outside those hours, every login attempt is automatically denied regardless of who the user is or what role they hold. Which element of the subject/object/rule access control model is being applied here?