Sensitivity Propagation
The rule that a derived dataset inherits the highest sensitivity of its inputs unless a named transformation demonstrably lowers it.
Classification applied only to source tables decays immediately. An analyst joins a restricted table to an internal one and writes the result to a new table, which is unclassified by default and therefore treated as internal — and now restricted data sits in an unrestricted location, with no rule broken and nothing to detect it.
Propagation closes the gap by inheritance: a derived dataset carries the maximum sensitivity of its inputs automatically, applied through lineage rather than by hand.
Lowering it requires a named, reviewed transformation — aggregation above a threshold, tokenisation, removal of identifying columns — recorded as the justification. Anything else is a manual override that needs an owner and an expiry.
Two subtleties bite. Aggregation is not automatically safe: a count grouped by postcode and diagnosis can identify individuals, so the threshold matters and it is a judgement rather than a formula. And columns are not independent — several individually innocuous attributes can jointly identify a person, so classification at column level with no view of the combination understates the sensitivity of the row. Both argue for review of the downgrade rather than an automatic rule.