Models and mechanisms

Models are the step between creating a policy and implementing it. They include detailed rule descriptions that don't depend on any given hardware, software or other mechanisms. 

Mechanisms can be software-based, such as an access control list or a physical item like a key or swipe card. Proper documentation will record which mechanisms will be used where.