A method and apparatus for maintaining a secure run-time environment in which arbitrary relationships between the subjects and objects of differing sensitivity labels are defined so as to provide for discrete access between arbitrary, normally incomparable sensitivity labels.