Labels become enforcement.

// Mechanism

The label is the gate.

The QHx admission controller applies and validates MLS labels at resource creation. Users cannot arbitrarily upgrade classification or escape a compartment by changing metadata after the fact.

• ClassificationResources receive levels such as unclassified, confidential, secret, or top secret equivalents.
• CompartmentSpecial-access or mission compartments constrain which workloads can interact.
• ReleasabilityPartner release sets can be bounded by the principal’s authorized groups.
• ImmutabilityClassification and compartment labels are protected against unauthorized change.