= Solution
First, the <Bell-LaPadula model> is a <information confidentiality> policy. It permits a low-level subject to overwrite a more highly classified object by blind writing. That can destroy a high-level file or introduce false data without disclosing its old contents. Thus it does not supply a <data integrity> policy, and it also does not ensure <service availability>. Modern <multiuser operating systems> require protection against modification and resource exhaustion as well as disclosure.
Second, a single hierarchy of classifications cannot express ordinary independent user ownership and selective collaboration. Two users at the same level may still need different permissions on their respective files; conversely, an authorised publication may deliberately release selected information to lower levels. The simple model lacks those owner-specific permissions and controlled release decisions. Adding <discretionary access control>, categories and explicit <declassification> mechanisms is substantial additional policy.
$$
\boxed{\text{It omits integrity requirements and cannot express ordinary selective sharing.}}
$$
Back to article page
