A secure security strategy in which the operating system requires credentials to be provided before access is given to any resource. Contrast with discretionary access control, in which the resource owner determines who can have access.