flow control restriction

No definition is given in NIST SP 800-171r3. The term is attested in use at 1 citation in that document; a definition is pending curation.

Increment 2: attested in 800-171r3 without a glossary definition.

The specific policy-derived constraints — such as blocking spoofed traffic, preventing unencrypted transmission of export-controlled data, or limiting cross-organizational data transfers by content type — that an organization imposes under an information flow control regime. They are distinguished from access control (which governs *who* may reach information) by governing instead *where* information may travel within or between systems, irrespective of who subsequently accesses it. In practice, security architects and compliance teams invoke the concept when specifying, auditing, or implementing the enforceable rules that make an information flow control policy (e.g., NIST AC-4) operational.

DR-088 backfill from the noun definition column

The set of specific, policy-derived enforcement mechanisms that constrain how information may move across boundaries within or between systems — governing the *path and channel* of data rather than who is authorized to read it. Distinguished from access control by its focus on transmission routes, content characteristics, and inter-system transfer conditions (e.g., blocking spoofed traffic, preventing cleartext export of controlled data, limiting proxy bypass), these restrictions operationalize an organization's information-flow control policy as enumerable, enforceable rules applied at network, application, and organizational boundaries. In practice, as articulated in NIST SP 800-53 AC-4, the concept governs where information can travel within and between systems — distinct from who is allowed to access it — with concrete examples such as blocking external traffic claiming an internal origin, keeping export-controlled information from being transmitted in the clear, and limiting transfers based on data structures and content.

Drafted by the propose-term web lookup (PD-018); a curator confirms or replaces it.