The Bell–LaPadula multilevel security model was derived from the DoD's multilevel security policies. The multilevel security policy states that a subject with any level of clearance can access resources at or below its clearance level.
Which Bell–LaPadula property keeps lower-level subjects from accessing objects with a higher security level?