1. A method for security planning with access control policies, comprising: receiving descriptions of available external inputs and processing components, wherein a first processing component description identifies data receivable by the first processing component, a function the first processing component performs on the received data and data produced by the first processing component as a result of performing the function; receiving first security-related requirements and a desired output result of a first network to be developed using the available external input and processing component descriptions; and generating the first network according to the security-related requirements, wherein the first network satisfies access control policies and includes external inputs and processing components, wherein the processing components are configured such that the first network produces the desired output result, wherein to satisfy the access control policies, the following rules are adhered to: (1) each processing component of the first network cannot accept any data that require an access class higher than the component's access class and (2) each processing component of the first network must label all data it produces with a minimum access class equal to or higher than the component's access class, yet after review of the operation of the processing components, at least one of the processing components is authorized to violate rule (2) and assign lower access classes to its data without incurring a security risk, wherein generating the first network according to the security-related requirements further comprises: verifying access control policies for the external inputs and processing components in the first network, based on subject labels assigned to the processing components and object labels assigned to the external inputs.