Over-Classification

Classification schemes usually propagate labels by taking the maximum of the inputs. It is the only safe default: a derived table built from Restricted data cannot be assumed to be less sensitive than its source.

Left without a downgrade path, that default has one outcome. Every derivative of one Restricted table is Restricted, and within a year most of the estate carries the top label. The controls that attach to it — named approval to query, no export, a restricted tool list — are then applied to aggregates and derived tables that plainly do not need them.

People do not stop working. They copy data into a spreadsheet, a personal notebook or an unlabelled sandbox, and the estate now holds sensitive data in places with no controls at all. Over-classification produces less protection, not more, and it does so while every dashboard reports improving coverage.

Why it matters

The security argument is usually made in one direction: a wrong label that is too low is a breach. A label that is too high is also a failure mode, just one whose damage appears as shadow copies rather than as an incident ticket.

It also destroys the signal. When 80% of tables are Restricted, the label no longer distinguishes anything, and a reviewer with limited time cannot tell which of 3,000 tables deserves attention.

Implementation patterns

• Keep maximum propagation as the default and add an explicit, reviewed downgrade.
• Define the downgrade as a test, not an opinion: no cell covering fewer than 5 users, no free-text column, small cells suppressed, geography fixed between releases.
• Record every downgrade with its evidence, its owner and a review date, so it is auditable and revisitable rather than folklore.
• Monitor the property, not the label. If a published table's minimum cell count falls below the threshold after a data change, the downgrade is void and publication should stop.
• Measure label distribution as a health metric. A rising share of the top label is a design problem, and it is visible months before anyone complains.

Industry example

Statistical agencies have run this exact trade-off for decades: cell suppression and minimum counts exist because publishing aggregates of confidential data is both necessary and dangerous. The formal version of the risk — that two harmless-looking releases can be differenced to recover an individual — was worked out in the differential privacy literature from 2006, and the practical defence remains what the agencies already did: publish the same cells every period, suppress small ones, and never let the geography be chosen per release.

Failure scenarios

• Shadow copies in spreadsheets and notebooks, which are the real breach vector and are invisible to the catalogue.
• A review queue that cannot keep up, so people classify high to avoid a conversation.
• Downgrades granted verbally and lost at the next audit, so the same argument is had again.
• Aggregates published as safe without a test, which is the opposite failure and just as real: a postcode with one case of a rare condition is a disclosure.

Trade-offs

A downgrade path costs review capacity and creates a decision someone can be wrong about. Refusing to build one costs shadow copies and an unusable signal. The exchange is not safety against convenience; it is a small number of reviewed, recorded decisions against a large number of unrecorded ones.

When not to use it

A small estate with few Restricted sources does not need a downgrade process. If almost nothing is derived from sensitive data, maximum propagation costs nobody anything and the process would be pure overhead. And where a regulator requires formal disclosure control sign-off for derived data — parts of health and financial supervision do — the right answer is to route releases through that process rather than to invent a local rule that will not be accepted.

Interview question

Q: Your catalogue says 78% of tables are Restricted, and the security team reads that as good coverage. Argue the other side, and tell me what you would change in the next quarter.

What a strong answer covers: the label as a signal that has lost its power to discriminate; shadow copies as the predictable response to unusable controls; maximum propagation as the right default with a reviewed downgrade as the missing piece; downgrade criteria expressed as a measurable test; monitoring the test rather than the label; and label distribution as a metric to watch, with the honest admission that the first quarter's work is mostly declassifying aggregates nobody should ever have been stopped from reading.

Quick check

Quiz: What is the observable symptom of over-classification? — Sensitive data appearing in unlabelled places: spreadsheets, notebooks, personal sandboxes, while catalogue coverage looks excellent.

Flashcard: Why is maximum propagation still the right default? — Because a default must be safe when nobody has thought about it. The fix is a reviewed downgrade path, not a looser rule.