Formal state transition system of computer security policy that describes a set of access control rules designed to ensure data integrity