Skip to main content

Enforcement and Clearance

A classification only matters if it changes what a reader receives and where work is allowed to run. System9 enforces the ladder at the data path and treats clearance as a constraint on placement, not a preference.

Classification-aware reads​

Reads funnel through a single data chokepoint that authorizes each table, compiles row-level predicates into the query and masks columns on the way out, deny-closed. The reader's clearance decides what comes back:

  • When the reader's clearance dominates the data's classification, the read is served.
  • When access is allowed but the reader does not fully dominate the marking, the reader receives a redacted view, masked columns and filtered rows, rather than a denial or a leak. Higher strata are withheld, not silently declassified.

Redaction happens at more than one point, by design: column masks and row filters are applied at source in the query plan; sensitive fields are redacted at capture before they are recorded to an activity ledger; and streamed model output is scanned so that a sensitive match is held or redacted in the stream rather than escaping, and a match too long to hold is reported and blocked rather than pretending redaction was complete.

Clearance as a placement constraint​

Clearance is a hard input to where work runs, not only to what a reader sees:

  • Execution tier by classification. For sandboxed execution, the isolation tier is chosen from the combination of code trust, data classification, and cell regime, tighten-only, the dispatcher picks the lowest backend whose rank meets what is required and fails closed; it never downgrades. More sensitive data raises the isolation tier automatically.
  • Residency is structural. A residency guard refuses an off-replica read before any data moves, and only then applies clearance, both must pass to admit a read. An unrecognized clearance label maps to the most restrictive, so it cannot be used to escape a residency binding.
  • Result release by stratum. When a cross-cell computation reduces to results spanning several classification strata, the requester's clearance must dominate a stratum to receive it; higher strata are withheld, and each withheld stratum emits an audit record.
  • Join authorization. A cell must present a licence asserting compliance before it can enroll, and cross-border movement is refused at the replication transport by geofence.

On the edge, clearance and compartments are first-class fields on the device's delegation and on every authorization decision, and an agent's base authority starts at clearance zero, authority to touch classified data is granted explicitly and narrows down every delegation.

Design status

Enforcement is described by mechanism. The clearance-aware read chokepoint, tighten-only execution tiering, structural residency refusal, and per-stratum result release are the enforced constraints. Some declared at-rest controls, a per-compartment key enabled everywhere, cell-profile data-category allow/deny lists, and an at-rest content scanner, are not fully wired and are not claimed here as running.