This is kind of a core principle of mandatory protection systems (Class B for people familiar with the old orange book). Without this, it because difficult to

This is kind of a core principle of mandatory protection systems (Class B for people familiar with the old orange book). Without this, it because difficult to ensure security policies are subverted by users. There are also some really powerful security benefits when essentially nothing is anonymous.