In my lecture on formal methods in IT security as-well as on Wikipedia it is stated that the BLP model is a mandatory access control model. It is not clear to me why this is the case.
We have defined mandatory access control models as ones where modifications are constrained. I don't see why this is the case here. We have security properties (ss-property, *-property and ds-property) which restrict the set of protection states to a set of BLP-secure protection states, however it is possible to define a BLP system whose transition relation allows transitions in those states, then the system is just not BLP-secure anymore.