Classification — Internal

Require data classification labels on all memory writes and enforce minimum classification levels per scope. Global and shared memory require public classification; user-scoped memory allows internal data.

Policy JSON

{
  "memory": {
    "classification": "internal",
    "enforce_read_governance": true,
    "scopes": {
      "global": { "classification_required": "public" },
      "shared": { "classification_required": "public" },
      "user": { "classification_required": "internal" }
    }
  }
}

policy = {
    "memory": {
        "classification": "internal",
        "enforce_read_governance": True,
        "scopes": {
            "global": {"classification_required": "public"},
            "shared": {"classification_required": "public"},
            "user": {"classification_required": "internal"},
        },
    }
}

What It Does

Requires classification labels on all memory writes (public, internal, confidential, restricted)
Enforces scope-based rules — global/shared memory only accepts public data; user memory accepts internal or lower
Governs reads — agents can only read data at or below their classification level
Prevents accidental data leakage between scopes with different sensitivity levels

Example

Agent attempts to write confidential data to shared memory: Decision object:

{
  "action": "DENY_WRITE",
  "risk_score": 0.8,
  "reasons": ["classification_violation"],
  "evidence": {
    "data_classification": "confidential",
    "target_scope": "shared",
    "required_classification": "public",
    "allowed_classifications": ["public"]
  }
}

Install

# Install via CLI
tealtiger policy install classification-internal

# Or copy the JSON above into your tealtiger.config.json

Customize

Setting	Default	Description
`classification`	`internal`	Default classification for unlabeled data
`enforce_read_governance`	`true`	Enforce classification on reads, not just writes
`scopes.global.classification_required`	`public`	Maximum classification for global scope
`scopes.shared.classification_required`	`public`	Maximum classification for shared scope
`scopes.user.classification_required`	`internal`	Maximum classification for user scope

Classification levels from least to most sensitive: public → internal → confidential → restricted. For healthcare, set user scope to restricted and combine with the HIPAA Healthcare Pack.

Session Scope Only — Simpler approach: restrict scopes instead of classifying data
Deny Secrets in Memory — Block secrets regardless of classification
HIPAA Healthcare Pack — Uses restricted classification for PHI
TealMemory Documentation — Full API reference

Getting Started

Core Concepts

Governance Domains

Policy Authoring

Architecture

Integrations

Deployment

API Reference

Cookbook

Compliance & GRC

Guides

Reference

Versions

Playground

Dashboard

Blog

Classification — Internal

Policy JSON

What It Does

Example

Install

Customize

​Policy JSON

​What It Does

​Example

​Install

​Customize

​Related

Policy JSON

What It Does

Example

Install

Customize

Related