{"id":"mcs-restrictive-access-control","text":"MCS provides a restrictive supplementary access layer: enforced only after DAC and Type Enforcement pass, requiring conjunction of all assigned categories, with session-boundary enforcement of changes.","truth_value":"IN","source":"","source_url":"","source_hash":"","justifications":[],"dependents":[],"metadata":{},"explanation":{"steps":[{"node":"mcs-restrictive-access-control","truth_value":"IN","reason":"premise"}]}}