Security and governance

Markings and classification

Restrict access to data with markings and classification.

Markings restrict who can read data, on top of roles and resource permissions. Administrators manage them in Markings.

How markings combine

• Markings are conjunctive. A user needs every marking on a resource to read its data.
• Classification levels are hierarchical. A user cleared for a higher level can read data marked with a lower one.
• Releasability categories are disjunctive. Belonging to any one of the listed groups is enough for that category.

Propagation

Markings flow with the data. They are inherited down the folder hierarchy and along data dependencies, so a dataset built from marked inputs keeps their markings. The simulate feature shows what a change to markings would do before you apply it.

Data versus metadata

Markings protect contents. A resource's name may still appear in search for users without the markings, but they cannot open its data.

Markings and AI

AI tools read through the same ontology with the user's identity, so marked data never appears in an answer for someone who lacks the marking. Separately, the AI gateway refuses data classified as restricted unless the deployment allows it.