diff --git a/policy/mls b/policy/mls
index 665c1c69b..4cea4feec 100644
--- a/policy/mls
+++ b/policy/mls
@@ -572,14 +572,14 @@ mlsconstrain x_event { send }
 # MLS policy for the x_application_data class
 #
 
-# the x_application_data "paste" ops (explicit single level)
+# the x_application_data "paste" ops
 mlsconstrain x_application_data { paste }
-	( l1 eq l2 );
-
-# the x_application_data "paste_after_confirm" ops (downgrade permitted)
-mlsconstrain x_application_data { paste_after_confirm }
 	( l1 domby l2 );
 
+# the x_application_data "paste_after_confirm" ops
+mlsconstrain x_application_data { paste_after_confirm }
+	( l1 dom l2 );
+
 
 #
 # MLS policy for the pax class