Well-formed transaction

A well-formed transaction is one of the two pillars of the Clark-Wilson model. The idea: users must never manipulate data directly. Every change goes through a transformation procedure, a program certified in advance to take the data from one consistent state to another. If the certified procedures are the only doors into the data, then the data can never reach an invalid state, no matter what users attempt.

Banking gives the standard illustration. A transfer that debits one account must credit another in the same transaction; a procedure that could do one without the other would not be certified. The concept pairs with separation of duties, Clark-Wilson’s other pillar: well-formed transactions constrain how change happens, separation of duties constrains who can combine the steps. Together they defend against both error and fraud by authorised users, which simpler integrity models like Biba do not attempt.

Exam relevance: “users can only modify data through programs” or “data moves between consistent states” identifies Clark-Wilson immediately. The exam also tests the purpose: well-formed transactions address integrity in its fuller sense, consistency and correctness, not merely blocking unauthorised writers.