---
{
  "title": "Clark–Wilson model",
  "summary": "Protect business integrity through controlled transactions and separate duties.",
  "topic": "foundations",
  "level": "Intermediate",
  "updated": "2026-10-12",
  "units": [
    4
  ],
  "aliases": [],
  "sources": [
    {
      "title": "NIST: An Introduction to Information Security",
      "url": "https://csrc.nist.gov/pubs/sp/800/12/r1/final"
    },
    {
      "title": "Clark and Wilson: Comparison of Commercial and Military Computer Security Policies (historical paper)",
      "url": "https://theory.stanford.edu/~ninghui/courses/Fall03/papers/clark_wilson.pdf"
    }
  ],
  "published": "2026-10-02",
  "editorialVersion": 2
}
---

## The idea

Clark–Wilson models integrity around well-formed transactions. Protected data changes through certified transformation procedures, while integrity verification procedures check validity. Users are authorized for particular procedures rather than being allowed to edit every protected item directly. Separation of duties reduces the chance that one person can both create and conceal an improper transaction. This makes the model relevant to business records that must remain internally consistent.

## In practice

A finance application requires one operator to prepare a payment and another to approve it. The application updates balances through a controlled transaction rather than raw spreadsheet edits.

## A common misunderstanding

Integrity is not only a hash check. A record can be byte-for-byte preserved and still represent an invalid business transaction.

## Check your understanding

Why separate preparation and approval?

**Think it through:** It limits unilateral abuse and provides an independent check on the transaction.

## Preserve a valid business state

A fictional warehouse records stock movements. A legitimate dispatch should reduce inventory and create a corresponding shipment record through one controlled operation. Allowing an operator to edit either table directly can leave an internally inconsistent state even if every byte is stored accurately. The integrity goal concerns the relationship between records and the procedure that changes them.

The model distinguishes protected constrained data from inputs that have not yet been brought under the integrity policy. A certified transformation procedure must handle the latter according to defined rules before protected state is changed. Users are authorized to particular procedures over particular data, rather than receiving unrestricted editing power.

Certification and enforcement have different roles. Someone must establish that a procedure preserves the intended conditions, while the system enforces who can execute it and what it can affect. Auditability and separation of duties support accountability around those decisions. A button labelled approved is insufficient if another route permits raw changes.

## Sketch one controlled stock transaction

Using dummy warehouse records, define the initial valid state, the permitted dispatch request, and the expected final state. Identify the validation checks, authorized operator, independent review where required, and audit record. Add an impossible quantity and a duplicate request as cases needing explicit outcomes.

Now inspect an administrative import that bypasses the normal procedure. Explain how it could undermine the integrity design even when the main interface works correctly. The model is useful because it connects business correctness, controlled transformations, and authority. Applying it requires understanding the actual invariant the organization wants to preserve, rather than reducing integrity to a file hash or a generic permission check.

## Keep exploring

- [[separation-of-duties]]
- [[biba]]
- [[access-control]]