Subjects and objects each have a set of security attributes .
Subjects and objects each have a set of security rules .