Restricting Users to a Single Label

If a system is configured to run with only a single sensitivity label, all non-administrative user accounts on that system are restricted to work at that single sensitivity label. In such systems, the clearance for every user's account would necessarily be set to be equal to the account's minimum sensitivity label.

In systems running with multiple sensitivity labels, any account may be restricted to work at a single sensitivity label if the security administrator role sets the account's clearance equal to its minimum sensitivity label.

When the security administrator role has configured an account with a account label range that includes multiple sensitivity labels, the user can voluntarily restrict a working session to a single sensitivity label, which is explained in the next section.