Skip to main content

The Classification Ladder

System9 expresses sensitivity on a single ordered ladder, with compartments for need-to-know layered on top. One normalization function and one dominance comparison define the ladder, so every part of the platform compares classifications the same way.

The five levels​

The ladder is drawn as a monochrome value ramp, lightest for the least sensitive rung, darkest for the most, so it reads identically in color and in grayscale, and the rung name is always printed. There is a deliberate hole at rank 3:

Figure E1: the classification ladder. Five rungs on a dark-to-light ramp, with a deliberate gap at rank 3 (amber, dashed) where RESTRICTED was retired and folded into CONFIDENTIAL; UNCLASSIFIED is an alias of PUBLIC. Compartments (cyan) are an orthogonal axis, need-to-know held in addition to dominating the level, not a sixth rung. A guard test fails the build if a level is added.

Table equivalent

RungRankNote
PUBLIC0UNCLASSIFIED is an alias of PUBLIC
INTERNAL1
CONFIDENTIAL2Absorbs the retired RESTRICTED rung
(rank 3)3Deliberately empty: RESTRICTED retired; the hole is kept on purpose
SECRET4
TOP SECRET5
CompartmentsOrthogonal cross-axis; need-to-know, checked separately from the level

These five levels are the platform's entire information-flow vocabulary. They replaced several competing schemes, and a guard test fails the build if a level is introduced, the ladder is meant to stay exactly this size, because every enforcement point depends on comparing against it. The gap at rank 3 is retained rather than renumbered, so a stored rank never silently changes meaning across a version.

Dominance and information flow​

Access is decided by dominance: a subject's effective clearance must dominate (be greater than or equal to) the classification of the data to read it without restriction. The flow rules are:

  • No read up. A subject cannot read data classified above its clearance.
  • No write down. Data cannot be written to a destination classified below it.

These are enforced through the permission resolver rather than being advisory markings. A cross-domain transfer upward is allowed; a transfer downward requires explicit authorization and is audited.

Compartments​

Beyond the linear ladder, compartments express need-to-know. A subject must hold the compartment as well as dominating the level, clearance and compartment membership are separate checks, and both must pass. Compartments have their own registry and dominance comparison, and per-compartment key derivation is part of the cryptographic design, so a denial can name which rule refused.

Unmarked data fails closed​

The most dangerous label is a missing one. System9 treats an unmarked or unrecognized classification as the most restrictive, not the least:

  • An unmarked asset is treated as top secret for need-to-know purposes, so it is withheld rather than leaked while its true marking is established.
  • An unrecognized classification label maps to the most restrictive clearance, so an unknown label cannot be used to escalate privilege or slip data downward.
  • A storage-lifecycle floor refuses to move data whose label it does not recognize, rather than tiering it into a less protected place.

An earlier gap that allowed an unknown marking to be placed on any cell, a live information-flow bypass, has been closed; unmarked now fails closed to the top.

The same ladder on the edge​

The Edge Agent defines the same five-level ladder and enforces no-read-up at the boundary where a query reaches data. The ladder is not a cell-only construct that degrades on a disconnected device. It is compiled into both runtimes.

Terminology

This is the information classification ladder. It is distinct from two other uses of the word "classification" in the platform: the tactical protected-object categories (for example hospital, school, civilian) used for rules-of-engagement, and a device's self-classification of its own operating mode. Those are different vocabularies for different purposes.