In general

  • Subject and objects have security attributes

  • Access determined based on policy rules