---
{
  "title": "Bell–LaPadula model",
  "summary": "A formal model focused on confidentiality across classification levels.",
  "topic": "foundations",
  "level": "Intermediate",
  "updated": "2026-10-12",
  "units": [
    4
  ],
  "aliases": [],
  "sources": [
    {
      "title": "NIST: An Introduction to Information Security",
      "url": "https://csrc.nist.gov/pubs/sp/800/12/r1/final"
    },
    {
      "title": "Cristia and Rossi: Automated Proof of Bell–LaPadula Security Properties",
      "url": "https://arxiv.org/abs/2001.10512"
    }
  ],
  "published": "2026-10-02",
  "editorialVersion": 2
}
---

## The idea

Bell–LaPadula models information flow between security classifications. In its familiar formulation, the simple security property prevents reading above a subject’s level, and the star property prevents writing below it. These rules aim to prevent classified information from flowing into a less protected destination. The model is deliberately about confidentiality; it does not solve every integrity, availability, or practical access-control requirement.

## In practice

A person with Secret clearance cannot read a Top Secret record, and cannot copy Secret information into an Unclassified record under the model’s basic rules.

## A common misunderstanding

“No read up, no write down” describes information-flow restrictions, not a complete policy for every real organization.

## Check your understanding

Which goal explains the restriction on writing down?

**Think it through:** Confidentiality: prevent high-classification information leaking into a lower classification.

## Follow information rather than job seniority

A fictional laboratory assigns documents Public, Restricted, and Highly Restricted labels. A process handling Highly Restricted material must not place that material into a Public output under the simplified confidentiality rules. The concern is the direction of information flow, not whether the operator is an experienced manager.

Subjects are active entities, such as processes acting for users, while objects hold information. A user's maximum clearance and a process's current security context are related but distinct ideas in practical multilevel designs. Introductory examples simplify those details, so state the assumptions before applying the mnemonic to a scenario.

The model does not decide whether a document's contents are correct. A Highly Restricted record can contain a factual mistake while still being protected from disclosure. Integrity and availability requirements need separate reasoning. Likewise, real systems must address authorized release, trusted components, and possible covert channels beyond the basic classroom rule.

## Draw a three-level flow table

For the fictional laboratory, label three dummy documents and a process at the middle level. Mark permitted and prohibited reads and writes under the stated simplified formulation. Explain each answer using confidentiality rather than memorized arrows.

Then add a request to publish an approved summary. Do not simply remove a label to make the example work; identify the need for a separately controlled release process. The exercise reveals both the model's value and its limits. Historical formal models help make security goals precise, but they are not a ready-made configuration for every modern application. A useful design begins with the required information-flow property and explains how actual enforcement and exceptions preserve it.

## Keep exploring

- [[cia-triad]]
- [[biba]]
- [[clark-wilson]]
- [[access-control]]