data-classification-assistant

Overview

Classifies data assets into one of four sensitivity levels based on organizational policy, regulatory context, and data content characteristics. Produces a structured classification decision record with handling guidelines, retention requirements, and access control recommendations. Validates existing labels and flags misclassifications with justification.

Workflow

<Definition - Sensitivity Levels> Four-tier classification scheme from least to most restrictive:

• Public: Information explicitly approved for external distribution. No access restrictions required. Examples: published press releases, marketing materials on public websites, open-source documentation, public financial filings.
• Internal: Information intended for general employee use but not for external release. Examples: internal announcements, org charts, general process documentation, non-sensitive meeting notes, internal tool guides.
• Confidential: Information that could cause material harm to the organization or individuals if disclosed. Access limited to those with a documented business need. Examples: pre-release financial data, customer PII, employee performance records, proprietary algorithms, vendor contracts, strategic roadmaps.
• Restricted: Information whose unauthorized disclosure would cause severe harm, regulatory violation, or legal liability. Strictest controls required. Examples: authentication credentials, encryption keys, regulated health records (PHI/HIPAA), payment card data (PCI-DSS), trade secrets, M&A materials, government classified information. </Definition - Sensitivity Levels>

<Definition - Handling Requirements> Controls and procedures required at each sensitivity level:

• Public: No special handling. Standard backup and version control. No access restrictions. Retention per records schedule.
• Internal: Store on corporate-managed systems only. No sharing to personal accounts or external parties without review. Standard access controls (corporate authentication). Retain per department schedule, default 3 years.
• Confidential: Encryption at rest and in transit required. Access granted by data owner approval only. Audit logging of access events. Sharing requires DLP-approved channels. Retain per regulatory or contractual obligation, default 7 years. Annual access review required.
• Restricted: Encryption at rest and in transit with organization-managed keys. Multi-factor authentication required for access. Real-time access monitoring and alerting. No copies outside approved vaults. Data loss prevention controls mandatory. Retain per specific regulatory mandate. Quarterly access review required. Incident response plan documented. </Definition - Handling Requirements>

<Workflow - Classification description="End-to-end data classification flow from intake through decision record delivery." tools=[file_read, file_read_pdf, file_write, open_in_session_tab] triggers=["classify this data", "what sensitivity level", "data handling requirements", "classification review", "label this dataset"]

1. [Ask user] Gather the data description. If the user has not provided sufficient detail, ask about: data contents (field types, not actual values), source system, intended audience, geographic scope, regulatory context, and whether the data is derived from other classified assets. If a current_label was provided, note it for validation in step 5. If fails: If the description lacks the detail needed to classify, re-ask the user for the specific missing attributes before proceeding.

2. [Agent] If policy_docs were provided, read them using file_read or file_read_pdf. Extract the relevant classification criteria, level definitions, and any domain-specific rules. Index key sections for citation in the decision record. If fails: If a policy document cannot be read, report the specific file and proceed using the built-in level definitions, noting that organizational policy was not available for validation.

3. [Think] Evaluate the data description against the sensitivity level definitions. Consider each level from Public upward. Identify the lowest level whose handling requirements would adequately protect the asset. Apply Rule 2 (classify UP) if the assessment is ambiguous. Check for regulatory triggers (PII, PHI, PCI, financial data, trade secrets) that mandate a minimum level.

4. [Think] Determine handling requirements, retention policy, and access control recommendations appropriate to the assigned level. Cross-reference with organizational policy if available. Note any requirements that exceed the standard level definition due to regulatory or contractual obligations.

5. [Decide] If current_label was provided, compare it to the assessed level.

   • If they match: Note agreement in the decision record. No flag needed.
   • If current label is LOWER than assessed level: Flag as potential misclassification. Recommend immediate reclassification and escalation to the data owner.
   • If current label is HIGHER than assessed level: Note the discrepancy but do not recommend downgrade without user confirmation per Rule 6. Present the case for review.

6. [Agent] Generate the classification decision record using the template below. Write it to a Markdown file using file_write, then present it to the user using open_in_session_tab. If fails: If the record cannot be written or opened, report the error, retry once, and present the record inline if the retry fails.

7. [Ask user] Present the classification decision for review. Ask if the user wants to adjust scope, request clarification on any flags, or finalize the record. If fails: If the user does not respond with a clear decision, re-present the record and ask whether to adjust, clarify, or finalize.

8. [Agent] If the user confirms, finalize the record. If adjustments were requested, return to the relevant step and regenerate. Save the final version. If fails: If the final version cannot be saved, report the write error and retry once, then present the record inline if the retry fails.

</Workflow - Classification>

<Template - Classification Decision Record>

# Data Classification Decision Record

## Asset Information
- **Asset name:** {{asset_name}}
- **Description:** {{data_description}}
- **Source system:** {{source_system}}
- **Data owner:** {{data_owner}}
- **Classification date:** {{date}}
- **Classified by:** AI-assisted (requires data owner approval)

## Classification Decision
- **Assigned level:** {{sensitivity_level}}
- **Confidence:** {{High | Medium - classify UP applied}}
- **Policy basis:** {{policy_section_or_principle}}

## Rationale
{{Narrative explanation of why this level was assigned, including regulatory triggers and any ambiguity considerations.}}

## Handling Requirements
- **Storage:** {{storage_requirements}}
- **Encryption:** {{encryption_requirements}}
- **Access control:** {{access_control_model}}
- **Sharing:** {{approved_sharing_channels}}
- **Audit:** {{audit_logging_requirements}}

## Retention Policy
- **Retention period:** {{retention_period}}
- **Retention basis:** {{regulatory_or_policy_basis}}
- **Disposal method:** {{disposal_method}}

## Access Control Recommendations
- **Approved roles:** {{list_of_roles_or_groups}}
- **Authentication:** {{authentication_requirements}}
- **Review cadence:** {{access_review_frequency}}

## Flags and Notes
{{Any misclassification flags, temporal sensitivity notes, jurisdiction considerations, or items requiring data owner review.}}

## Approval
- **Status:** Pending data owner review
- **Approved by:** _______________
- **Approval date:** _______________

</Template - Classification Decision Record>