The system administrator must have some way of specifying the labels that are to appear on the output. Hardcopy output must be labeled at both the beginning and the end of the document with labels representing the overall sensitivity of the output. Also the top and bottom of each page must be labeled to reflect the overall sensitivity of the output or the specific sensitivity of the information on that page. Documentation must include a model of the security policy supported by the system. It need not be a mathematical one, but it must be a clear statement of the rules enforced by the system's security features .
Testing is more stringent.
A file's sensitivity label specifies the level of trust that a user must have to be able to access that file. Layers communicate with each other through calls via clearly defined interfaces. In terms of system architecture , processes have no more privilege than they need to perform their function. Other, less critical, modules should call on more privileged routines only as needed and only for the duration of the needed operation. The process of identifying oneself to, and having one's identity authenticated by, a computer system .