Data Classification
Data classification is the process of categorizing data based on its sensitivity level and the impact of unauthorized disclosure. Common tiers include public, internal, confidential, and restricted. Classification determines which security controls, access policies, and handling procedures apply to each data set.
Why It Matters
Data classification is a prerequisite for meaningful agent governance. If an organization does not know which systems contain sensitive data, it cannot write policies that distinguish between low-risk and high-risk agent actions.
In agent governance architectures, data classification informs policy rules. A tool call that reads from a public knowledge base might be auto-approved. The same type of tool call against a restricted database might require human approval. The policy engine needs the classification context to make this distinction.
Organizations that have completed data classification can implement agent governance policies immediately. Organizations that have not face a bootstrapping problem: they need to classify their data before they can write effective agent policies.