Operating system that provides sufficient support for multilevel security and evidence of correctness to meet a particular set of requirements