What scheme includes the requirement that the system maintain the separation of duty
requirement expressed in the access control triples?

A.
Bella

B.
Lattice

C.
Clark-Wilson

D.
Bell-LaPadula

Explanation:
Separation of duty is necessarily determined by conditions external to the computer system. The
Clark-Wilson scheme includes the requirement that the system maintain the separation of duty
requirement expressed in the access control triples. Enforcement is on a per-user basis, using the
user ID from the access control triple.