Q is target and R is implementationLet Q be the set of secure states specified by security policy and R be the set of states restricted by security mechanism.R typically larger than RSecure mechanismPrecise mechanismBroad mechanism (most in common)