-
(a): Enforce [one of ] over the set of covered subjects and objects specified in the policy; and
-
(b): Enforce [one of ] over the set of covered subjects and objects specified in the policy.
Supplemental
Simultaneously implementing a mandatory access control policy and a discretionary access control policy can provide additional protection against the unauthorized execution of code by users or processes acting on behalf of users. This helps prevent a single compromised user or process from compromising the entire system.