What scheme includes the requirement that the system maintain the separation of duty
requirement expressed in the access control triples?

A.
Bella

B.
Lattice

C.
Clark-Wilson

D.
Bell-LaPadula

Explanation:
Separation of duty is necessarily determined by conditions external to the computer
system. The Clark-Wilson scheme includes the requirement that the system maintain the
separation of duty requirement expressed in the access control triples. Enforcement is
on a per-user basis, using the user ID from the access control triple.