When configuring settings in a mandatory access control environment, which of the following specifies the subjects that can access specific data objects?

In MAC, the Owner of a data object does not have discretionary authority to grant or revoke access to others; that power belongs to the centrally controlled administrative policy.

The System enforces the access control rules mechanically once they are defined, but it does not specify or author which subjects can access which objects - that decision-making role belongs to the Administrator.

In a MAC environment, the Administrator is responsible for defining and enforcing access control policies, including assigning security labels to subjects and objects and specifying which subjects are permitted to access specific data objects. Unlike discretionary access control (DAC), individual users and even data owners cannot override these centrally administered rules. The administrator configures the policy framework that the system then enforces.

Users in a MAC environment are subjects whose access is controlled and restricted by policy; they have no authority to specify who can access data objects.