Leonard LaPadula

At MITRE in the early 1970s, LaPadula and David Elliott Bell were asked by the US Air Force to formalise what it means for a computer to handle classified information securely. The answer, the Bell–LaPadula model, boils down to two rules: no read up (users can't read above their clearance) and no write down (programs can't leak secrets to lower levels).

In 1976 they published a consolidated version with an interpretation for Multics, and the model became the basis for the upper tiers of the Orange Book. It only covers confidentiality; integrity was left to Ken Biba, who flipped the rules upside down, and to David D. Clark.