A security label always has a null, or unrestricted, label value and can have one or more additional label values. These non-null label values can be defined to allow access only to users who are cleared for that label value. Cleared users are called authorized participants. Security label values that clear all users can be used as purely informative markings.

The following topics go into more detail about security labels, security label values, and exceptions to security labels—agreements.