Architects designing a multilevel public-safety records system must choose a classic model based on protection goals. When the dominant requirement is stopping unauthorized disclosure across clearance levels, which selection is most appropriate?

Choosing a classic access-control model for multilevel public-safety records must follow the dominant protection goal, not brand familiarity. When the primary requirement is stopping unauthorized disclosure across clearance levels—preventing read-up of more sensitive records—a confidentiality-oriented model such as Bell-LaPadula is the appropriate selection. Selecting Biba because “integrity models automatically satisfy confidentiality” is false: integrity and confidentiality lattices solve different threats; Biba will not substitute for no-read-up secrecy controls. Selecting Clark-Wilson solely because public safety might involve invoices confuses domain flavor with model purpose; Clark-Wilson targets well-formed commercial transactions and integrity, not MLS disclosure. Ignoring models and using one shared password across clearance bands collapses all separation into a single secret and fails both confidentiality and accountability. Exam caveat: CISSP scenarios often ask you to pick the model that matches the stated goal; correct answers explicitly tie confidentiality goals to Bell-LaPadula-style choices. Operational check: capture the system’s primary objective in the architecture decision record (disclosure prevention versus integrity of updates), map clearances to labels, implement matching MAC or policy engine rules, and validate with negative tests that lower clearances cannot retrieve higher-banded case files.