Which access control model would be MOST appropriate for a government system that must enforce strict information classification and cannot allow users to override access decisions?
