UX Spec: Smart Markings (MVF 0) [in progress draft]
Overview
Smart Markings introduces the ability to assign attributes directly to channels, DMs, and GMs. For this MVF 0 effort, we are focused on implementing channel based attributes.
Channel attributes are assigned by channel administrators and become persistent indicators of the channel's security posture and permitted use. The classification level attribute — previously a display-only label — is elevated to an actual channel attribute, creating for the first time a direct, auditable connection between what a channel displays and what governs access to it.
To best express the model for implementation, lets begin with the system administrator point view:
Membership Policies: System Administrator
An administrator can establish a membership access policy via the Membership Policies page from the System console. When establishing a policy, the administrator first specifies the particular attributes a user must have in order to receive access. Furthermore, they can specify where this particular membership policy applies. It can be enforced across the entire workspace, by manually selecting specific channels and teams, or have it apply dynamically, to only channels and team with matching attributes.
Attribute Management: Channel Administrator
A channel administrator can control access to a channel by choosing to add required attributes during the channel setup experience. These controls will be made available during channel creation as well as through channel configuration. Should a channel administrator change the configuration and the outcome would force users to be removed, they will be asked to confirm before proceeding.
For the MVF 0, we will limit this to existing/established attributes. Channel administrators will not be able to build new attributes at this screen currently but will be able to in the future.
Display and Extension of Channel Attributes
Channel attributes are not limited to classification. Classification is one of many attribute types that channels can carry. The Classification level attribute will initially draw on the model established by the Classification Compliant Information Marking project — elevating it from a display label to an actual channel attribute that can be used in ABAC policy evaluation. Program attributes, which are currently assigned to users, will also be applicable to channels. Additional attribute types specific to channels may need to be defined as requirements are developed and customer use cases are refined.
System administrators designate which attributes are displayed as visible labels in the channel header, on a system-wide basis. Labels are short tags — not extended text strings. Color coding for labels is optional; if used, color assignments must be consistent across the system. Not all assigned attributes will appear as labels: some may be assigned to channels and referenced in policy without being surfaced in the channel UI.
Classification Markings: Out of the Box
As a continuation of the Classification Markings effort, this MVF includes introducing the option to channel administrators of whether they want the classification markings on their channel to be displayed as a channel banner below the channel name and details, or as a channel header label in line with the channel name, positioned to the right.
Enforcement Attributes
Smart Markings introduces the concept of Enforcement Attributes: a system administrator can designate specific attribute types as enforcement-grade. When setting up an access policy, the administrator can specify if all, or only specific attribute requirements are required in order to gain access.
When an Enforcement Attribute is assigned on a channel, Mattermost automatically generates a mandatory, non-overridable ABAC policy restriction for that channel corresponding to the assigned value. This restriction is system-generated and immutable at the channel level — a channel administrator cannot remove or reduce it.
Extendability of Access Policies by Channel Administrators
A channel administrator can add additional conditions to the channel's access policy, making access stricter than the enforcement baseline, but cannot relax the enforcement restriction. For example: if a channel is assigned Classification = Confidential, Mattermost automatically applies a restriction requiring that any user accessing the channel must hold Classification >= Confidential. A channel admin may add further conditions — such as requiring a specific program clearance — but cannot lower the classification threshold below Confidential.
This provides a secure, automatic guarantee that a channel's classification label and its access policy are always aligned, eliminating the need for administrators to manually author or maintain the underlying policy for standard classification enforcement.
Membership Enforcement
If a channel has an existing set of Enforcement Attributes a list of those attributes will be displayed when attempting to add new users to a channel. Only users who have the necessary attributes will be able to be added to the channel.