Labelling before deciding

Why sort information by how sensitive it is before working out who should see it?

The intuitive order is: someone asks for access, we think about whether they should have it, we decide. Classification looks like an extra step bolted on the front — go and stamp every file internal or confidential first, then decide.

But hold that intuition up to a system with forty thousand tables and eight hundred people who might want them. How many access decisions is that? And who is making each one, on what basis, at what hour of the day? The step that looked like overhead starts to look like the only thing that makes the rest finite. It is worth working out exactly what it is buying.

Consider the decision itself: may this person see this thing? What does answering it require? Something about the person — their role, their team, their training, their contract. And something about the thing — how bad would it be if this leaked.

Now notice the asymmetry between those two halves. The facts about the person change constantly: people join, move team, take on projects, leave. The facts about the thing are far more stable. A table of patient diagnoses is highly sensitive today and will be highly sensitive in three years, regardless of who asks for it.

So if you decide access case by case, you re-derive the stable half every single time — and you re-derive it from scratch, by whoever happens to be answering, at a moment when someone is waiting. That is where classification earns its place. It computes the stable half once, records it as a label, and lets every later decision read the answer instead of recomputing it.

Then a second, sharper benefit. What is a policy actually written against? If you write rules about records, you need a rule per record and the rules never end. If you write them against labels, you write a handful: restricted data may not leave the production environment; confidential data requires named approval; internal data is open to employees. Now the number of policies is bounded by the number of labels, not by the number of datasets — and a new dataset arriving next week is governed the moment it is labelled, with nobody writing anything new.

Can you see what has happened structurally? Classification is an indirection. It puts a small, stable vocabulary between an unbounded set of data objects and an unbounded set of rules, so the two sides no longer have to be joined item by item.

That also explains the ordering in the question. The label has to exist first because the policy binds to it. Reverse them — decide access first, then label — and the label becomes a description of decisions already taken, which is documentation rather than control.

There are honest limits. Sensitivity is not entirely a property of the data on its own: a set of individually harmless fields can become identifying when combined, which is why a derived or joined dataset can deserve a higher label than any of its inputs. And derived data inherits sensitivity unless something actively removes it — an extract, a copy in a spreadsheet, a model trained on the rows. A label that does not travel with the copies is protecting only the original.

The other limit is human. Over-classification is the standard failure: when in doubt people stamp everything with the highest label, because nobody was ever disciplined for being too careful. Then the controls attached to that label become intolerable, people route around them, and the scheme stops describing reality. Which is why schemes with three or four levels tend to survive and schemes with eight do not.

Three refinements worth holding onto.

First, the misconception that classification is access control. It is not; it is the input to access control. The label says how much harm a disclosure would do. It says nothing about whether a particular person has a legitimate need. Both halves are required, and a scheme that quietly conflates them ends up granting access to everyone whose clearance level matches, regardless of whether they have any business with the data at all.

Second, a label is only useful if it is bound to the data rather than kept beside it. A classification held in a spreadsheet somewhere is a hopeful annotation. A classification carried as column-level metadata that a query engine, a masking rule, and a data-loss check can all read is a control. The difference is whether anything actually enforces it.

Third, classification is not a one-off project. Sensitivity changes: a merger becomes public, a personal identifier is removed, an aggregate becomes disclosive when the population shrinks. So the label needs a review path and a reclassification event, which is exactly the part most schemes leave out and then wonder why they drift.

• Why aggregation and joining can raise sensitivity above that of any input.
• Automated classification and scanning, and how far its confidence can be trusted.
• Retention and disposition as the natural continuation of a classification scheme.

Every term the collection defines is gathered in the glossary.