/ 01The canonical 5-level ladder
One ladder, every silo. Choose any, defend it forever.
| Level | Examples | Default cross-silo ceiling |
|---|---|---|
| Public | Published articles, public filings, marketing | L6 (no restriction) |
| Internal | Routine work product, non-sensitive precedents | L5 (claims visible) |
| Confidential | Most client matters; commercially sensitive | L3 (sanitised abstract) |
| Restricted | Sensitive deals, regulatory investigations | L2 (facets only) |
| Privileged | Privileged advice, ethical-wall content | L1 (existence) — or L0 |
/ 02Per-silo mapping
Each silo carries a mapping file (YAML) that converts its native taxonomy to canonical levels. The file is signed, audited, and editable through the admin console.
silo_id: sil_mueller_berlin source: imanage native_to_canonical: "Public": Public "Internal": Internal "Confidential": Confidential "Highly Confidential": Restricted "Privileged": Privileged "Wall - Project Helios": Privileged # Custom wall label fallback: Confidential # Used when native label is missing or unrecognised
/ 03Source-specific mappings
- iManage — security class labels per document; mapping is straightforward
- NetDocuments — classification by cabinet; entire cabinet maps to one canonical level
- Litera Foundation — metadata field
SensitivityLevel; values configurable per firm - SharePoint / Graph — Microsoft Information Protection labels; mapping by GUID
- Manual upload — explicit level required at upload; no auto-mapping
/ 04α vs β cross-check
The DMS native classification is the α classification — authoritative. Atrium also runs an independent β classifier at ingest, an internal model that reads the extracted text and emits a canonical level.
If α and β agree, ingest proceeds. If they disagree, the document is flagged with classification_disagreement: true and routed to the steward queue.
Disagreement does not block disclosure — α wins by default — but the steward sees both and can promote either, with audit.
/ 05Editing & audit
Mapping changes affect every document in the silo. Edits require:
- Silo Admin authority + second approver from Group Compliance
- A written rationale (free text, persisted)
- Step-up authentication (see step-up authentication)
Applying a change triggers a reclassification cascade across affected documents.
/ 06Disagreement handling
Two pathways:
Routine disagreement
β suggests Confidential, α says Internal. Steward sees the side-by-side; usually a one-click "trust α" or "promote to β". Logged.
Critical disagreement
β suggests Restricted or Privileged, α says Internal. The document is held at L1 across silos until reviewed; SLA 4 hours.