A procedure to ensure that information transfers within an information system (IS) are not made from a higher security level object to an object of a lower security level.