Information sensitivity classifications are defined and approved in data management policy so that they are mutually exclusive and reflect business risk and value, integrated with cross-organization control function policies and embedded in the culture. Business rules are defined for: the order of precedence (the higher level applies when classifications conflict); combinations of elements whose collective sensitivity exceeds that of each element (a name, a surname and a home address together identify a person); aggregating element classifications to the repository or application that holds them; treating unclassified data and setting defaults; and anticipating classification changes during the lifecycle. Labels are few, instantly recognizable and may be content-derived or user-driven, with conflicts between automatic and manual assignment reconciled across repositories; further classification types may support regulatory and business needs.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.