Ontology

Object security

How permissions and markings apply to objects.

Converge checks every read and write on the server, whatever application or API is used.

Visibility and masking

Authorization policies decide which object types a user can see and which properties are masked. The same rules apply to the API, to applications and to AI tools, because they all read through the ontology.

Markings on data

Markings restrict who can read data:

• Markings are conjunctive. To see marked data you need every marking on it.
• Markings propagate. They are inherited down the file hierarchy and along data dependencies, so a dataset derived from marked data stays marked.
• Data, not metadata. A resource's name and description may remain discoverable, but its contents need the data markings.

See Markings and classification for classification levels and releasability.