Investigation Security Classification

Overview#

A counter-terrorism investigation that becomes visible to unauthorized personnel stops being an investigation and starts being a security incident. The stakes of improper information disclosure in intelligence and law enforcement contexts are not abstract: lives and operations depend on access controls working exactly as configured, every time, for every user. The Security Classification module applies government-grade information protection to investigation data, enforcing hierarchical classification levels, compartmentalization rules, and dynamic access controls that adapt in real time as clearances change.

Beyond intelligence and law enforcement, financial institutions handling sensitive fraud investigations, multi-agency task forces coordinating across classification boundaries, and enterprises managing privileged corporate investigations all require the same rigour. The module supports the full classification lifecycle, from initial marking through declassification review and controlled external sharing.

Key Features#

• Hierarchical Classification Management: A four-tier classification hierarchy (Public, Confidential, Secret, Top Secret) with content-based classification recommendations, automatic marking generation, and derivative classification support ensures investigations are protected according to sensitivity.
• Clearance-Based Access Control: Multi-level security enforcement validates user clearance levels, compartment authorizations, and need-to-know requirements in real time, with automatic access revocation when clearances expire or change.
• Compartmentalized Access Programs: Fine-grained access controls beyond base classification levels through compartmented access programs and special access requirements enable need-to-know enforcement at the investigation, evidence, and document level.
• Automated Classification Marking: Security banners, portion markings, dissemination controls, and classification authority blocks are automatically generated and applied according to government marking standards.
• Declassification Management: Automated time-based, event-based, and review-based declassification workflows with exemption tracking process large volumes of declassification reviews while maintaining compliance.
• Security Audit and Monitoring: Real-time policy enforcement, anomaly detection, continuous monitoring of suspicious activity indicators, and immutable audit logging provide forensic trails for security incidents and compliance reviews.
• Cross-Compartment Analysis: Safe data fusion from multiple compartments with automatic sanitization, portion marking, and audit trails enables analysts to work across security boundaries when authorized.
• Dynamic Classification Review: Machine learning models analyse investigation content to recommend appropriate security levels, with automated classification guidance reducing analyst decision time.
• Data Loss Prevention: Classification-aware policies prevent unauthorized information spillage through email gateway integration, endpoint controls, and export restrictions.

Use Cases#

• National Security Investigation Classification: Intelligence agencies classify investigations with appropriate security levels, compartment restrictions, and handling caveats, with automated marking ensuring compliance throughout the investigation lifecycle.
• Financial Crime Investigation Security: Banks and financial institutions apply confidential classification to sensitive fraud investigations, with automatic upgrades and access re-validation when law enforcement partnerships begin.
• Declassification Review and Public Release: Automated scanning identifies investigations eligible for declassification, with security officers reviewing content sensitivity and applying exemptions or approving release with appropriate sanitization.
• Cross-Organization Secure Sharing: Sharing classified investigations with external partners through secure portals with automatic marking, access controls, and audit logging maintains classification integrity during collaboration.
• Compliance Audit Preparation: Automated compliance reporting and complete audit trails satisfy security standards requirements for regular examinations and accreditation renewals.
• Insider Threat Detection: Anomaly detection and user behaviour analytics identify suspicious access patterns, unusual access times, high-volume downloads, and other indicators of potential insider threats.

Integration#

The Investigation Security Classification module integrates with the platform's investigation management, evidence management, and identity management systems. Classification policies are enforced across all investigation interfaces, and clearance verification connects to personnel security databases and HR systems. The module supports integration with security information and event management platforms for real-time event forwarding, data loss prevention systems for classification-aware policies, and identity providers for single sign-on with multi-factor authentication.

Open Standards#

• STANAG 4774 Ed 1 (NATO Confidentiality Metadata Label Syntax): Classification labels are generated, serialised, and persisted as STANAG 4774 XML structures, with the full four-tier NATO and EU classification hierarchy mapped to the standard's Annex A values and nato markings.
• STANAG 4778 Ed 1 (NATO Metadata Binding Mechanism): Every persisted security label is cryptographically bound to its payload using an HMAC-SHA256 binding hash computed and validated per STANAG 4778, so any tampering with either the label or the content is detectable.
• NATO C-M(2002)49 (NATO Security Policy Framework): The policy identifier urn:nato:policy:c-m(2002)49 is embedded in every generated label as the authoritative reference for the classification levels and handling caveats enforced by the module.
• EU Council Decision 2013/488/EU (EU Classified Information Security Rules): EU classification grades (RESTREINT UE/EU RESTRICTED, CONFIDENTIEL UE/EU CONFIDENTIAL, SECRET UE/EU SECRET, TRES SECRET UE/EU TOP SECRET) are implemented alongside NATO grades and serialised in STANAG 4774 labels, enabling cross-domain classification across NATO and EU frameworks.
• GraphQL (June 2018 specification): All classification operations, label inference, human review, entity marking retrieval, and review-queue queries, are exposed exclusively through a typed GraphQL API with strawberry-defined schema and permission enforcement.
• OAuth 2.0 / JSON Web Tokens (RFC 6749 / RFC 7519): Authentication and authorisation on every classification endpoint is enforced via Bearer JWT tokens, with clearance level and organisation scope carried as claims and validated before any label read or write operation is permitted.
• HMAC (RFC 2104) with SHA-256 (FIPS 180-4): The STANAG 4778 binding hash is computed using HMAC-SHA256, providing tamper-evident integrity assurance for all exported or persisted classified artefacts.

Last Reviewed: 2026-02-23 Last Updated: 2026-04-14