Reference Monitor
The abstract concept of the thing that actually says "no" — an access-control checkpoint that mediates every subject-to-object request, can't be bypassed, and is small enough to verify.
Three properties define a reference monitor: it mediates every relevant access (no bypass), it’s tamper-proof (an attacker can’t disable it), and it’s small enough to be verifiable (you can actually convince yourself it’s correct). Modern architecture reuses the same idea under a new name — the Policy Enforcement Point in XACML and Zero Trust is a reference monitor for the distributed-systems era.