A formal statement of the intrinsic security features to be provided by a system. The statement usually includes a detailed specification, often in mathematical notation, of the allowed and prohibited relationships between subjects and objects according to their respective security clearance and security classifications. It may furthermore specify the events that must be recorded in the audit trail.