The foundation for security enforcement is access control.Resources must be protected against access by unauthorized entities.Furthermore, authorized entities must be prevented from accessing resources in inappropriate ways.A major challenge to the developer of an access control policy is to provide users the flexibility to protect their resources as they see fit; system policies that am inconsistent with user needs are inadequate.In particular, systems that enforce a single, hard-coded policy cannot satisfy the needs of all users.As part of the Distributed Trusted Operating System (DTOS) program, we have developed and implemented a flexible security architecture using the Mach microkemel.In this architecture, the security rules enforced by the system are defined by a system component outside the microkemel.This reduces the problem of sup porting other security policies to redefining this system component; the same microkemel can be used to support a wide range of policies.Formal methods were used to provide a rigorous approach for the development of the policy.Recognizing that most people are uninterested in reading security requirements stated in formal specification languages, an approach was developed for representing and maintaining the policy in a tabular format.This paper describes the flexibility of the DTOS security architecture and the approach used in developing the access control policy for this flexible architecture.It also gives examples of how to detine a component that makes security decisions for the microkernel.''This work was suppxted in patt by the Maryland F'mcurement Office, contract MDA904-93C-4209 and was performed in cooperation with mscarchers at the Information Security Computer Science Rcseaxh Division of the Department of Jkfense.