Which access control model is the most restrictive model typically used in defense or military organizations where data classification and confidentiality are of prime importance