In short
An AI agent connected to the company drive has to gather the quarter's decisions for the sales team. Among the files it can reach is the board minutes on the acquisition of another company, with the word CONFIDENTIAL in the footer. The agent processes the footer as one more line of text, and the summary mentions the negotiation. The data classification was on the document, and no system read it. Making that label count at query time is one of the jobs of the Company Brain, the layer that knows the company: what data exists, where it lives, how it relates and who can see what.
Data classification is the assignment, to each data set, of a sensitivity level that determines who may access it, where it may travel and which controls protect it. Restricted data requires named access, encryption and a log of every read. Public data can go on the website.
The idea comes from information security. NIST, the United States standards institute, published in 2004 the FIPS 199 standard, which categorises information by the impact of a loss of confidentiality, integrity or availability, on three levels: low, moderate and high. Corporate scales follow the same logic.
The scale most companies use has four levels:
Cross-cutting categories run across the scale and indicate which obligations come with the data:
Classification is done by the data owner, the business person who answers for it. The HR manager classifies the employee database, and the finance director classifies the cash projections.
Data classification happens at three levels of granularity: by source, when the whole payroll system is rated restricted; by field, when the taxpayer ID (CPF) and phone number get their own level in the CRM; and by document, when each contract gets the level of its content.
At a company's volume, automatic rules recognise patterns, such as taxpayer ID numbers, diagnosis terms or contract headers, and suggest a level. The owner reviews the ambiguous cases, because a false public exposes the data and a false restricted holds up the work.
Many programmes end with an approved policy and a stamp in the document footer. The stamp guides anyone who reads carefully. Systems treat the footer as ordinary text.
Another version lives in a spreadsheet. The security team keeps the list of systems with their levels, and no tool checks that list before delivering data.
Before AI, much of the sensitive data was protected by the effort it took to find it, in subfolders and attachments nobody opened. An agent reads that material in seconds, and the result goes to whoever asked the question.
That is why classification comes before the sources are connected. It makes it possible to decide what may go into each tool, each context and each person's view. A sick-leave report can feed the answer for the HR analyst handling the case and stays out of the answer for the department head.
A summary of the acquisition minutes carries the information in the minutes and therefore inherits their classification. A table that combines internal data with a restricted column takes the highest level among its inputs.
Without this inheritance, AI opens a path to silent reclassification: the restricted document stays protected, and its summary circulates in the team channel.
The Company Brain connects CRM, ERP, helpdesk, drive and other sources once and organises that data into a knowledge graph, a business ontology and a semantic layer. Data classification becomes an attribute of entities and fields, alongside the permission inherited from the source system.
For each question, the slice goes through two checks. The inherited permission confirms whether the person already sees that record at the source. The classification confirms whether that level and that category may be part of the answer in that context and with that model. Only then is the slice served over MCP, the open protocol that connects models to data sources.
The ontology holds the inheritance rule, and a summary generated from restricted entities is recorded with the highest level among its sources. Every answer points to the origin and classification of each piece of data.
The architecture applies the classification that exists. An internal folder may start receiving medical reports. Without periodic review by the owner, the recorded level describes an old situation.
Emails, transcripts and long documents mix passages of different levels in the same file. Automatic rules get the ambiguous cases wrong, and part of data classification still depends on human review.
Classifying the whole collection before the first use case tends to stall the project. The practical starting point is to list the sources the first agent will query, name the owner of each one and set the minimum level per source.
In the same round, each owner marks the fields and folders that fall outside that level, such as the diagnosis column in an HR system classified as internal. Those markings go into the Company Brain before the connection, and each following use case adds only the sources not yet classified.
