MandatoryLabel gets or sets the mandatory label of this SACL. If the mandatory label is retrieved it returns the mandatory label instance directly. Do not free it! If no label was found (HasMandatoryLabel = false) the return value is nil. 

The label can be changed whithout regarding access checks. Access checks are performed in SetSecurityInfo. Only the first label is changed. Any additional labels are ignored. The given mandatory label instance will be copied into a new instance and added automatically to the list. Do not use the parameter ListOwner of the Create constructor. Do not write this:

  audit.MandatoryLabel := TJwSystemMandatoryAccessControlEntry.Create(MandatoryLevelHigh);

Instead use a variable to prevent a memory leak:

var ML : TJwSystemMandatoryAccessControlEntry;
  ML := TJwSystemMandatoryAccessControlEntry.Create(MandatoryLevelHigh);
  audit1.MandatoryLabel := ML;
  ML.Free;
  audit1.OwnsObject := true;

Also set OwnsObject to true so the copied instance will be freed automatically. 

You can also use SetMandatoryLabel to define how the instance will be treated.

TJwSAccessControlList Properties