A procedure to ensure that information transfers within a system are not made from a higher security level object to an object of a lower security level. See covert channel, simple security property, star property (*-property). Synonymous with data flow control and flow control.