For mandatory access control, the following rules, due to Bell and La Padula, are imposed:
- User i can retrieve object j only if the clearance level of i is greater than or equal to the classification level of j.
- User i can update object j only if the clearance level of i is equal to the classification level of j.
For the second rule, I can understand for the insert case. Such rule is necessary in order to prevent a user with secret classification from copying secret data to a file of lower classification. But why for delete and modify? Why should not a user from higher class delete and modify data of the lower class?