flow control restrictions include

The specific policy-derived constraints — such as blocking spoofed traffic, preventing unencrypted transmission of export-controlled data, or limiting cross-organizational data transfers by content type — that an organization imposes under an information flow control regime. They are distinguished from access control (which governs *who* may reach information) by governing instead *where* information may travel within or between systems, irrespective of who subsequently accesses it. In practice, security architects and compliance teams invoke the concept when specifying, auditing, or implementing the enforceable rules that make an information flow control policy (e.g., NIST AC-4) operational.