Clark-Wilson model

Clark-Wilson approaches integrity the way a business does, not the way a military classification scheme does. Its core move is the access triple: subject, program, object. Users never touch constrained data items directly; they act through certified transformation procedures, programs vetted to change data only in valid ways. Integrity verification procedures then audit that the data still satisfies its rules.

Two principles do the heavy lifting. A well-formed transaction guarantees data moves only from one consistent state to another, and separation of duties ensures the person who certifies a procedure is not the person who uses it. Where the Biba model only prevents unauthorised modification, Clark-Wilson also addresses authorised users making improper changes, which is exactly the fraud scenario commercial systems care about. The Clark-Wilson guide works the model end to end.

Exam relevance: the phrases to pattern-match are “access triple”, “users modify data only through programs”, “well-formed transactions”, and “separation of duties”. Any of those in a scenario points at Clark-Wilson; if the scenario is purely about levels of trust in data sources, it is Biba.