Here we put a security label on the content for the intranet. When the publisher tries to write this content to the internet site the TCB will prevent this "write-down" which would cause a disclassification of confidential information. This works even though the publisher has read/write access to the internet site.