A small, self-contained collection of key security-related statements that works as a privileged part of an operating system, specifying and enforcing, criteria that must be met for programs and data to be accessed.