The containment of subjects and objects in a system in such a way that they are separated from one another, as well as from the protection controls of the operating system.