When implementing the Biba Integrity Model, which operation is restricted for a subject to maintain the integrity of a higher-level object?