Classic Security Models Guide: Bell-LaPadula, Biba and Clark-Wilson Explained

Most access control failures are not bugs in a permission check but a policy nobody wrote down precisely: who may read what, where information may flow, and which steps must be split between people. Classic security models are formal statements of exactly those rules. Bell-LaPadula protects confidentiality by controlling information flow between classification levels, Biba protects integrity by stopping low-trust data from contaminating high-trust data, and Clark-Wilson protects commercial integrity through well-formed transactions and separation of duties. This guide explains each model, how it works, where it is still enforced today (SELinux, Windows integrity levels, financial systems), and why the same ideas are suddenly useful again for AI agents. It is for practitioners designing authorisation and for candidates studying for certifications such as CISSP.

Key takeaways

• Bell-LaPadula is about confidentiality. Its two rules are "no read up" (the simple security property) and "no write down" (the *-property), so secrets cannot leak to lower levels even through a compromised program.
• Biba is the integrity mirror image. Its rules are "no read down, no write up", so untrusted input cannot corrupt trusted data; Windows Mandatory Integrity Control applies a no-write-up default.
• Clark-Wilson fits business systems. Data may change only through certified transformation procedures, users are bound to programs and programs to data, and duties are separated.
• The reference monitor is what makes any model real. It must mediate every access, be tamper-proof and be small enough to analyse, a requirement unchanged since James Anderson's 1972 study.
• The models map directly onto AI agent risk. An agent that reads confidential data and then writes to an attacker-visible channel is a textbook *-property violation.

What it is

A security model is a precise, usually mathematical, description of a security policy that a system can be checked against. The CyBOK Authentication, Authorisation and Accountability knowledge area places these models in the family of mandatory policies, where the system, not the resource owner, decides access. Under discretionary access control (DAC) the owner grants rights to identities; under mandatory access control (MAC) subjects and objects carry labels and the system enforces the policy whatever owners want. CyBOK notes the terms are used loosely: MAC today often just means any system-mandated policy, such as SELinux.

Many classic models are lattice-based. Security levels form a partially ordered set in which any two levels have a least upper bound and a greatest lower bound. A level combines a hierarchical classification (Unclassified, Confidential, Secret, Top Secret) with a set of categories or compartments. Level A dominates level B when A's classification is at least B's and A's categories include all of B's.

The US Trusted Computer System Evaluation Criteria (TCSEC, the "Orange Book", DoD 5200.28-STD, December 1985) turned these ideas into procurement requirements: mandatory access control and sensitivity labels start at class B1, and from B2 a formal model of the security policy must be maintained and proven consistent with its axioms.

How it works

Bell-LaPadula (confidentiality)

D. E. Bell and L. J. La Padula's MITRE report Secure Computer System: Unified Exposition and Multics Interpretation (ESD-TR-75-306, March 1976) defines a state machine and three properties a secure state must satisfy:

• Simple security (ss) property: a subject may have observe access to an object only if the subject's level dominates the object's level. This is "no read up".
• *-property (star property): a subject may not observe one object while altering another whose level does not dominate it. In practice, relative to its current level, a subject may append only to objects at or above that level and write (read and alter) only at an equal level. This is "no write down", and it stops a Trojan horse running at Secret copying data into an Unclassified file.
• Discretionary security (ds) property: every current access must also be permitted by the access matrix, so DAC applies on top of MAC.

Strictly applied, the *-property means nobody could ever declassify anything, so the report introduces trusted subjects, which are exempt from the *-property and must be shown not to copy high information downwards. Most real MLS systems depend on a small set of such trusted processes.

Biba (integrity)

Biba labels subjects and objects with integrity levels and, as CyBOK describes it, applies the dual rules: no read down (a high-integrity subject must not be influenced by low-integrity data) and no write up (a low-integrity subject must not modify high-integrity objects). Biba's low watermark variants are dynamic: a subject that reads low-integrity data drops to that level. Windows Mandatory Integrity Control is a practical descendant: processes run at low, medium, high or system integrity, every object gets SYSTEM_MANDATORY_LABEL_NO_WRITE_UP by default, unlabelled objects are treated as medium, and the integrity check happens before the DACL is evaluated.

Clark-Wilson (commercial integrity)

David Clark and David Wilson presented their model at the 1987 IEEE Symposium on Security and Privacy, arguing that commercial integrity depends on well-formed transactions and separation of duty rather than on levels. NIST SP 500-160, the report of the 1987 Workshop on Integrity Policy in Computer Information Systems, summarises the elements:

Chinese Wall (conflict of interest)

The Chinese Wall model, usually credited to Brewer and Nash, captures dynamic conflict-of-interest rules for consultancies serving competing clients. CyBOK describes how accessing one client's data removes permission to access other clients in the same conflict-of-interest class. Unlike the lattice models, permissions change with the subject's history.

The reference monitor

None of these models protects anything unless an enforcement point applies it. James Anderson's Computer Security Technology Planning Study (October 1972) defined the reference monitor, which validates every reference a program makes, and three principles for its implementation: tamper-proof, always invoked, and small enough to be subject to analysis and tests. TCSEC repeats them for class B3. NIST SP 800-53 Rev. 5 still carries the idea as control AC-25 Reference Monitor. See the Reference Monitors and Mandatory Access Control Guide for how Linux enforces it.

Why it matters

Decision guidance

• Choose a lattice (BLP-style) policy when data has stable classification levels and leakage is the main risk, as in defence or cross-domain gateways. Expect usability cost and a need for trusted downgrade processes.
• Choose integrity levels (Biba-style) when the threat is untrusted content driving trusted actions: browsers, document readers, build systems and AI agents.
• Choose Clark-Wilson thinking for business processes: identify the CDIs, force all change through approved transactions, and split duties. This works at any size; small organisations implement it with approval workflows and reconciliations rather than new software.
• Use RBAC, ABAC or ReBAC to express day-to-day permissions, and the classic models to check those permissions cannot violate a flow rule. See the Authorisation Models Guide.

The AI agent connection

The EchoLeak 2025 Microsoft 365 Copilot incident is a classic-model failure in modern form. A crafted email (low-integrity input) steered the assistant, which then read sensitive internal data (read up) and placed it in an image reference fetched from outside (write down). A Biba rule says untrusted content must not drive privileged actions; a BLP rule says a context holding confidential data must not write to a lower-classified channel. Applying both to an agent means labelling its inputs and outputs, lowering its effective level when it ingests untrusted content, and restricting outbound channels once confidential data is in context. See the Prompt Injection Guide.

How to apply the models

1. Classify: define confidentiality levels and integrity levels for data and systems. See the Data Classification Guide.
2. Map flows: list where data moves between levels and mark each downgrade or upgrade path.
3. Enforce at a reference monitor: kernel MAC, gateway, policy engine or agent tool proxy, never in client code.
4. Run in audit mode first: SELinux permissive mode or policy engine log-only mode shows what would be denied.
5. Measure: track denied cross-level flows, the number of trusted subjects and downgrade exceptions, segregation of duties conflicts found by IVP-style reconciliation, and time to remove a conflict.

Common misconceptions

• "No write down is about permissions on files": it is about information flow. Any channel counts, including logs, URLs, error messages and tool calls.
• "Bell-LaPadula also protects integrity": it does nothing to stop a low-level subject writing up and corrupting high-level data; that is Biba's job. CyBOK notes that BLP's write-up rule was an unanticipated twist when applied to real IT systems.
• "A formal model proves the system is secure": it proves the policy is consistent. Implementation flaws, covert channels (TCSEC requires covert storage channel analysis from B2) and trusted subjects remain. CyBOK also notes that execution monitors can enforce only safety properties.
• "Clark-Wilson is just separation of duties": separation is one rule among nine; well-formed transactions, verification procedures and logging matter as much. See the Segregation of Duties Guide.
• "These models are obsolete": they are embedded in SELinux, Windows integrity levels, browser sandboxes and financial controls, and they give the clearest vocabulary for AI agent data flows.

Related concepts

• Least privilege: the operational partner of every model. See the Least Privilege Techniques Guide.
• HRU safety: CyBOK notes that deciding whether a right can leak in the general access matrix model is undecidable, which is one reason restricted models like these remain valuable.
• Certification study: see the CISSP Certification Guide.

Practitioner checklist

• Write down which property each system needs most: confidentiality, integrity or conflict-of-interest control.
• Define confidentiality and integrity levels and assign them to data stores, services and agents.
• Identify every downgrade path and make each one a named, logged trusted process.
• For business data, list CDIs and the only transactions allowed to change them.
• Run reconciliation (IVP) jobs and treat failures as incidents, not data quality noise.
• Enforce policy at a single, tamper-resistant enforcement point and test it in audit mode first.
• Apply no-write-down rules to AI agents: restrict outbound channels once confidential data is in context.

Standards and references

• MITRE: Bell and La Padula, Secure Computer System: Unified Exposition and Multics Interpretation
• US Air Force ESD: Anderson, Computer Security Technology Planning Study
• US DoD: Trusted Computer System Evaluation Criteria (DoD 5200.28-STD)
• NIST: SP 500-160 Workshop on Integrity Policy in Computer Information Systems
• CyBOK: Authentication, Authorisation and Accountability Knowledge Area
• Microsoft Learn: Mandatory Integrity Control
• NIST: SP 800-53 Rev. 5

Related NHI Mgmt Group resources: Authorisation Models Guide · Reference Monitors and Mandatory Access Control Guide · Segregation of Duties Guide · Least Privilege Techniques Guide