A type of access controller that restricts the flow of information in a distributed system having parts of differing security clearance. The filter allows a part with high clearance to read from a part of lower clearance but prevents the converse operation.