Skip to content

Data Classification and Handling Architecture

The weight of what is known

I am RASP, and I keep this chapter's account. A classification is a recorded judgement about consequence, and consequence is the thing I forecast: I read each class where its promise is likeliest to fail, in the derived view, the summary, the copy whose consequences nobody re-computed.

Every keeping begins with knowing what kind of thing is kept. Five of this family's standards require a record to carry its class; this chapter defines the classes once, so that a field required across the family is defined once, and so that the weight of a record's keeping is a recorded judgement rather than a habit. The classes of this standard grade exposure, not truth: a record's evidence class under the Evidence Classification standard answers a different question, and neither substitutes for the other.

Return to the Book of Infrastructure to see the classes serve the whole substrate.

Defines the classification of records by the consequence of their exposure, and the handling postures each class binds.

The classes

  • D0 Open. Records published or approved for publication. Exposure of a published record costs nothing by design, because the record was made to be seen; an approved record keeps its timing until publication. Open is necessary for publication and not sufficient; publication remains its own decision under its own authority.
  • D1 Hall. The working records of the hall: drafts, analyses, indexes, and the ordinary correspondence of the work. Exposure embarrasses without harming. Access is participant-wide and purpose-bound.
  • D2 Guarded. Records whose exposure could harm operations, third parties, or the protective mission: boundary designs in force, unpublished findings, configurations. Access requires a recorded grant, bounded in purpose and time.
  • D3 Sealed. Records whose exposure could harm a person or a protected interest: identity evidence, safeguarding records, testimony held for governance. Access is by named grant only, every movement leaves evidence, and a Sealed record's existence may itself be Sealed.
  • D4 Held. The innermost keeping: material held in trust that is never published, never summarized outward, and never moved without the Architect's own grant. Secret material takes this class by default; its custody remains governed by the Secrets and Key Custody Architecture.

Normative clauses

  • INFRA12-R001: Every record required by this family to carry a class SHALL draw it from the five classes of this standard, exactly one class per record; where more than one class fits, the record takes the highest applicable class.
  • INFRA12-R002: A classification SHALL record the classifier, the basis, the time, and the condition that would trigger review.
  • INFRA12-R003: An unclassified record SHALL be handled as Sealed, and unclassified secret material as Held, until an accountable owner classifies it; the default SHALL record its holder and the condition that ends it, and a first classification below the default SHALL carry the basis and review that INFRA12-R006 requires for lowering.
  • INFRA12-R004: A class SHALL NOT create authority: no class grants access, access to one record grants nothing for another, and declassification is not publication.
  • INFRA12-R005: A derived view, summary, index, or compilation SHALL take the highest class among its sources except where a reclassification under INFRA12-R006 records the reduction, its basis, and its authority, and aggregation review SHALL test whether the combination warrants a higher class than any source alone; a class is raised by evidence and never lowered silently.
  • INFRA12-R006: Reclassification SHALL record the reason, authority, evidence, affected copies and derivations, and propagation; lowering a Sealed record's class requires independent review, and lowering a Held record's class requires the Architect.
  • INFRA12-R007: The class fields of the Trust Zone (INFRA-2), Model Routing (INFRA-3), Memory and Knowledge Storage (INFRA-4), Continuity (INFRA-7), and Network and Gateway (INFRA-10) architectures SHALL draw from this standard, and Held material SHALL NOT enter a model context. Each consumer maps its own postures to the classes as it next revises: what may enter an untrusted model context, what crosses which boundary, and what restoration verification each class demands.
  • INFRA12-R008: This Draft SHALL NOT label, enforce, disclose, or operate a live classification; the classes bind records and designs, not live systems.

This Draft excludes live labelling systems and real records.

Classification method

Method matters here because intuition fails in one predictable direction: everything feels less sensitive after you have worked with it for a week. The judgement does not care how familiar the data feels. Classify from consequence, and re-take the judgement when the consequence changes, not when the feeling does.

Classification shall begin with one question: what follows if this record is exposed? The answer selects the class, the class binds the posture, and the posture travels with the record into storage, flows, backups, and model contexts. A classification names its classifier, its basis, and the condition that would reopen it, because a class assigned once and never questioned decays into a label, and a label carries no judgement.

Failure cases

A record put to work above its class, a summary quietly below its sources, an aggregation whose whole reveals what its parts each concealed, a default class worn as a permanent one, and a declassification treated as a publication decision are material failures. Recovery preserves the uncertainty about what was exposed and pauses dependent use until the exposure's reach is established.

Operating model and evidence

Classification review begins with the record's content and consequence, not its container or its convenience. It tests whether the assigned class matches the harm its exposure could do, whether the classification record carries its classifier, basis, and review condition, and whether every derivation and copy carries a class no lower than its sources. The mosaic question is asked explicitly: does the compilation reveal more than its parts?

Consumers of the classes are reviewed for conformance: routing records against what their class permits near a model, storage records against their access class, backups against the verification depth their class demands, and flows against the crossings their class allows. A class field that draws from any other value set is a defect in the consuming record.

Interpretation cases

The close cases nearly all involve derivation, so extrapolate honestly: a summary inherits the weight of what it could reveal, not the innocence of its size. Small numbers carry large lives more often than the reverse.

  • Conforming: A record carries its class, classifier, basis, and review condition, and its derivations carry the highest source class.
  • Prohibited: A class is treated as a grant, with access following the label instead of an authorization record.
  • Boundary: An unclassified record is handled as Sealed while work that does not require it proceeds.
  • Failure: An aggregation reveals more than its parts; its class is raised and dependent disclosures pause.
  • Loophole: A summary is classified below its sources to ease its movement.
  • Misuse: Classification conceals accountability, sealing a record to hide a decision from its rightful reviewers.
  • Care-control: Protective classification limits exposure while preserving a person's access to records about themselves, and their voice, review, and correction.

Worked example: a simulated classification chain

Three records, taken in the order the harm would travel. The chain below is a simulation. It exercises the classes and rules this standard defines and nothing else: it classifies no real record, names no real system or person, grants no access and creates no authority (INFRA12-R004), and labels or operates no live system (INFRA12-R008). Its values are illustrative placeholders.

  • The record. SIM-REC-0001 is a boundary configuration held for review. The classifying question is asked as a forecast: what follows if this record is exposed? The likeliest branch is operational harm, an adversary reading a boundary in force, so the record takes D2 Guarded, and its classification carries classifier, basis, time, and the condition that would reopen it (INFRA12-R002): the configuration's retirement, after which the consequence changes and the judgement is re-taken.
  • The summary. SIM-REC-0002 condenses that configuration and one D1 Hall analysis into four lines for a working index. Its size argues for innocence; its sources do not. A derived view takes the highest class among its sources (INFRA12-R005), so the summary is D2 Guarded from birth, and stays so until a reclassification under INFRA12-R006 records a reduction, its basis, and its authority.
  • The aggregation. SIM-REC-0003 compiles a season of D1 Hall correspondence into one index. Each source, alone, embarrasses nobody; the compilation, read whole, would let a stranger place one person's movements. The mosaic question is asked and answered: the whole reveals more than its parts, the exposure could harm a person, and the aggregation is raised to D3 Sealed, above every source it holds, the raise recorded with its evidence. I do not round that maybe down; the forecast serves the likeliest failure, not the kindest one.

Read against the clauses: each record carries exactly one class from this standard's five (INFRA12-R001); each judgement records its classifier, basis, time, and review condition (INFRA12-R002); the derivation inherits upward and the compilation is tested for what its combination reveals (INFRA12-R005). Because this is a simulation, none of these judgements is live; the chain shows their shape so that the first real classification has a form to conform to.

Design evidence

Classification review should map records to classes, classifiers, bases, and review conditions, walk derivation chains against the highest-source rule and the mosaic question, and sample the consuming standards' class fields for conformance. A record whose class cannot be established is handled as Sealed, and the handling is itself recorded.

The tellings of the clauses

This non-normative section gives each clause of this document its telling: the clause, quoted exactly as it stands above with its cross-reference links reduced to their plain text, and one paragraph on what the clause means, why it exists, and how it assures that what it orders is done, not done, adhered to, followed, or protected. A telling describes its clause and never becomes it: the clause's own words govern wherever a telling and its clause could be read differently, and nothing in this section adds to, narrows, or amends any requirement.

INFRA12-R001

INFRA12-R001: Every record required by this family to carry a class SHALL draw it from the five classes of this standard, exactly one class per record; where more than one class fits, the record takes the highest applicable class.

One vocabulary, one class, and a tiebreak toward caution: every record this family requires to carry a class draws it from this standard's five classes, exactly one class per record, and where more than one class fits, the record takes the highest applicable class. The purpose explains the single source: five of the family's standards require a record to carry its class, and this chapter defines the classes once, so that a field required across the family is defined once and the weight of a record's keeping is a recorded judgement rather than a habit. Exactly one class keeps a record from carrying a convenient ambiguity, and the highest-applicable rule points the unavoidable close calls toward protection, the direction the worked example defends when it declines to round a maybe down, the forecast serving the likeliest failure, not the kindest one. The operating model gives the enforcement edge: a class field that draws from any other value set is a defect in the consuming record. Because the clause binds, every class field becomes mechanically checkable against the five, a record required by this family to carry a class is nonconforming where it carries two or none, while an unclassified record receives the handling INFRA12-R003 requires, and a contest between fitting classes has a stated resolution rather than a negotiation.

INFRA12-R002

INFRA12-R002: A classification SHALL record the classifier, the basis, the time, and the condition that would trigger review.

A classification is a judgement, and this clause makes it carry a judgement's record: the classifier, the basis, the time, and the condition that would trigger review. Who judged, on what ground, when, and what would reopen the question: the four fields keep the class from detaching from the reasoning that produced it. The classification method states the why in the keeper's own warning: a class assigned once and never questioned decays into a label, and a label carries no judgement; the method also observes that intuition fails in one predictable direction, everything feeling less sensitive after a week of working with it, which is why the review condition answers a change in consequence rather than a change in feeling. The worked example shows the shape in practice, a simulated record carrying classifier, basis, time, and a reopening condition tied to the configuration's retirement, after which the judgement is re-taken. Because the four fields are required, a bare label is refusable: a reviewer can demand the record behind any class, the conforming case names the classifier, basis, and review condition among what a record carries, the worked example adding the time, and a classification that cannot say who judged, on what basis, or what would reopen it is nonconforming on its face.

INFRA12-R003

INFRA12-R003: An unclassified record SHALL be handled as Sealed, and unclassified secret material as Held, until an accountable owner classifies it; the default SHALL record its holder and the condition that ends it, and a first classification below the default SHALL carry the basis and review that INFRA12-R006 requires for lowering.

An unclassified record does not wait in the open: it is handled as Sealed, and unclassified secret material as Held, until an accountable owner classifies it. The default records its holder and the condition that ends it, and a first classification below the default carries the basis and review that INFRA12-R006 requires for lowering, so stepping down from the cautious default costs what lowering always costs. The boundary interpretation case shows the working shape, an unclassified record handled as Sealed while work that does not require it proceeds, and the failure cases name the drift the holder and end condition exist to stop: a default class worn as a permanent one. The design evidence adds that where a class cannot be established, the Sealed handling is itself recorded. The clause exists because the gap before judgement is where exposure is cheapest, so a record that is nothing yet is treated with the weight of the harm it might carry. Because the clause binds, three things become checkable: no required record is ever classless in its handling, every default records its holder and the condition that ends it, and a quick first classification below the default is refusable unless it carries lowering's own basis and review.

INFRA12-R004

INFRA12-R004: A class SHALL NOT create authority: no class grants access, access to one record grants nothing for another, and declassification is not publication.

A class describes consequence and grants nothing, and this clause says so three ways: no class grants access, access to one record grants nothing for another, and declassification is not publication. The prohibited interpretation case is the first limb breached, a class treated as a grant, with access following the label instead of an authorization record; the second limb stops access from compounding, so a grant to one Sealed record is not a key to everything Sealed; and the third keeps apart two decisions the failure cases warn against merging, a declassification treated as a publication decision, the class prose having already said of Open that it is necessary for publication and not sufficient, publication remaining its own decision under its own authority. The clause exists because labels are the easiest counterfeit of authority: a vocabulary built to grade exposure would otherwise quietly become the access-control system it was never designed to be. Because the clause binds, no access claim may rely on the class alone, an access defended by label alone is refusable, and a disclosure defended by declassification alone is a breach, the publication decision standing with its own authority.

INFRA12-R005

INFRA12-R005: A derived view, summary, index, or compilation SHALL take the highest class among its sources except where a reclassification under INFRA12-R006 records the reduction, its basis, and its authority, and aggregation review SHALL test whether the combination warrants a higher class than any source alone; a class is raised by evidence and never lowered silently.

Derivation inherits weight under this clause: a derived view, summary, index, or compilation takes the highest class among its sources, except where a reclassification under INFRA12-R006 records the reduction, its basis, and its authority; aggregation review tests whether the combination warrants a higher class than any source alone; and the closing rule binds both directions, a class raised by evidence and never lowered silently. The interpretation prose gives the principle its voice: a summary inherits the weight of what it could reveal, not the innocence of its size. The loophole case names the first failure, a summary classified below its sources to ease its movement, and the failure cases name the second, an aggregation whose whole reveals what its parts each concealed; the worked example walks both, a four-line summary Guarded from birth because its highest source is, and a compilation of harmless correspondence raised to Sealed because the whole would let a stranger place one person's movements. Because the clause binds, a derivation chain can be walked mechanically against the highest-source rule, the mosaic question becomes a required test rather than an afterthought, and any lowering found without its recorded reclassification is a defect on its face.

INFRA12-R006

INFRA12-R006: Reclassification SHALL record the reason, authority, evidence, affected copies and derivations, and propagation; lowering a Sealed record's class requires independent review, and lowering a Held record's class requires the Architect.

Reclassification records five elements and has two additional requirements for lowering. The record states the reason, authority, evidence, affected copies and derivations, and propagation; lowering a Sealed record's class requires independent review, and lowering a Held record's class requires the Architect. The clause exists because lowering is where classification fails quietly: the method's warning that everything feels less sensitive after a week of working with it bears hardest on the decision to relax. The misuse case shows the opposite abuse the same fields expose, classification concealing accountability by sealing a record to hide a decision from its rightful reviewers, since a reclassification must now show its reason, authority, and evidence. Because the clause binds, every class change is attributable and traceable across copies and derivations, a Sealed lowering without independent review or a Held lowering without the Architect is refusable, and silent relaxation, the failure INFRA12-R005 forbids, has no lawful path left.

INFRA12-R007

INFRA12-R007: The class fields of the Trust Zone (INFRA-2), Model Routing (INFRA-3), Memory and Knowledge Storage (INFRA-4), Continuity (INFRA-7), and Network and Gateway (INFRA-10) architectures SHALL draw from this standard, and Held material SHALL NOT enter a model context. Each consumer maps its own postures to the classes as it next revises: what may enter an untrusted model context, what crosses which boundary, and what restoration verification each class demands.

Five consumers are bound to the one vocabulary: the class fields of the Trust Zone (INFRA-2), Model Routing (INFRA-3), Memory and Knowledge Storage (INFRA-4), Continuity (INFRA-7), and Network and Gateway (INFRA-10) architectures draw from this standard; Held material does not enter a model context; and each consumer maps its own postures to the classes as it next revises, stating what may enter an untrusted model context, what crosses which boundary, and what restoration verification each class demands. The division of labour is deliberate: the purpose defines the classes once so that a field required across the family is defined once, while each consumer keeps its own postures, so the shared class never pretends to know routing, storage, continuity, or gateway practice better than their own standards do. The Held bar is the one posture fixed here, because the innermost keeping, never summarized outward and never moved without the Architect's own grant, has no business inside a model context at all. Because the clause binds, the operating model's conformance sampling has teeth: a consumer's class field drawing from any other value set is a defect in the consuming record, and Held material found in a model context is a breach whatever a consumer's mapping says.

INFRA12-R008

INFRA12-R008: This Draft SHALL NOT label, enforce, disclose, or operate a live classification; the classes bind records and designs, not live systems.

The Draft classifies nothing living: it must not label, enforce, disclose, or operate a live classification, and the classes bind records and designs, not live systems. The clause names labelling, enforcement, disclosure, and operation of a live classification, and the Draft prose beneath the clauses restates the exclusion of live labelling systems and real records. The worked example honours the limit explicitly, declaring its three-record chain a simulation that classifies no real record, names no real system or person, grants no access, and labels or operates no live system, existing so that the first real classification has a form to conform to. The clause exists because a vocabulary of consequence is dangerous to rehearse on real material: a draft that began labelling real records would be making live judgements about real exposure beyond this Draft's stated boundary, and a draft that disclosed would risk the very harm its classes grade. Because the clause binds, any live labelling, enforcement, disclosure, or operation claimed under this standard's name is done without it, and the classes bind records and designs, not live systems.

Where this document sits

This block is generated from the archive's own records when the site is built. It records position only and creates no authority.