UX Spec: Classification Mapping and Enforcement
Overview
This spec defines the user experience for Classification Mapping and Enforcement in Mattermost, the functionality that evolves Classification Markings from display-only banners into actual access control. It builds on UX Spec: Classification Markings, which covers classification levels, country presets, and global/channel banners. This spec covers only the new functionality added to the Classification Markings page in the System Console.
A working prototype of everything described here is available in the proto playground: Classification Markings configuration. Use the Integrated Mapping scene (selected by default) in the top-bar scene switcher. A toggle in the top bar simulates the "no ranked attributes" edge case.
What's new in scope:
A Classification Enforcement section that lets admins gate access to classified resources based on a user's clearance
The ability to select an existing ranked user attribute as the clearance attribute, or create a new ranked attribute directly from the classification levels
An inline clearance mapping column in the Classification levels table that maps each classification level to a clearance value
Per-resource enforcement controls ("Apply classification markings to") that define which resources require classification and where markings display
Goals
Real enforcement: Move beyond informational markings; access to classified resources can be gated by a user's clearance attribute, managed through a corresponding Membership policy.
Build on the attribute system: Enforcement reuses ranked custom profile attributes (ABAC) rather than introducing a parallel clearance model. Any ranked attribute applied to users can serve as the clearance attribute.
Admin simplicity: Levels map to clearance values automatically by rank. An admin with no existing attributes can create a ranked attribute from their classification levels in one step, without leaving the page.
Flexible coverage: Enforcement and display are configured per resource type (Channels, Posts, Teams), and individual levels can opt out of requiring clearance entirely.
Terminology
Term | Definition |
|---|---|
Classification Enforcement | The mode in which classification markings participate in access control decisions. When enforced, users must hold a ranked clearance attribute value that meets each resource's classification level. Access is managed by a corresponding Membership policy. |
Clearance Attribute | A ranked custom profile attribute applied to users, whose ordered values represent clearance tiers (e.g., CONFIDENTIAL < SECRET < TOP SECRET). Only ranked attribute types are eligible. |
Clearance Mapping | The per-level assignment of a clearance attribute value to a classification level. Determines the minimum clearance a user must hold to access a resource marked with that level. |
Clearance not required | A per-level mapping option indicating that resources marked at that classification level are not gated by clearance (e.g., UNCLASSIFIED). |
Enforced Resource | A resource type (Channels, Posts, Teams) for which classification participates in access decisions. Enforced resources always appear in the "Apply classification markings to" section and cannot be removed from it while enforced. |
Admin Console UX (System Console)
All new functionality lives on the existing Classification Markings page under Site Configuration. The page order places enforcement configuration directly above the levels table, so admins choose a clearance attribute before mapping it to levels:
Page Sections
Enable classification markings + Classification preset (existing)
Classification Enforcement (new)
Classification levels, now with inline clearance mapping (updated)
Global Classification Indicators (existing)
Apply classification markings to (new)
As with the rest of the page, everything below the "Enable classification markings" toggle is disabled when that setting is False.
Classification Enforcement
Section description: "Restrict access to classified resources based on a user's clearance. When enforced, users must hold a ranked clearance attribute that meets each resource's classification level."
Enforce classification markings
How: A True/False radio button pair.
Label: "Enforce classification markings"
Help text: "When enabled, access can be gated by a users' clearance attribute. This will be managed by a corresponding Membership policy." ("Membership policy" links to the corresponding policy management surface)
When set to False, the "Clearance attribute" and "Resources to enforce" settings are hidden, and the clearance mapping column is removed from the Classification levels table. Existing configuration is retained and restored when re-enabled.
Clearance attribute
How: A dropdown of eligible user attributes, with a "+ Create new" button beside it.
Options: All ranked custom profile attributes, labeled with their type — e.g., "Clearance (Ranked)", "Sensitivity (Ranked)". Non-ranked attributes are not offered.
Help text: "Must be a ranked type applied to users. After you select an attribute, map it to each level in the Classification levels section below."
Behavior: Selecting an attribute immediately auto-maps its values to the classification levels by rank (see Clearance mapping below) and adds the mapping column to the levels table.
Empty state: no ranked attributes exist
If no ranked attribute exists in the system, the dropdown is replaced by a dashed empty-state panel:
Message: "No ranked attribute is available to map against. Create one from your classification levels to continue."
Action: A "+ Create ranked attribute" button that opens the same creation modal as "Create new".
Create ranked attribute (modal)
Opened from "Create new" (or the empty state's "Create ranked attribute"). Lets the admin seed a new ranked user attribute from the classification levels already defined on the page, without leaving the Classification Markings configuration:
Attribute name: A text field, pre-filled with "Clearance".
Levels to include: A checklist of the current classification levels (color swatch, level text, and rank), all selected by default. Help text: "Selected levels become the attribute's ranked values and map to classification levels by rank. Levels you leave out won't require a clearance value."
Footer: "Cancel" and "Create attribute" (primary). Create is disabled until the name is non-empty and at least one level is selected.
On create: The new attribute is created with one ranked value per selected level (preserving each level's rank), is auto-selected as the clearance attribute, and its values are auto-mapped to the levels. Levels that were left out map to "Clearance not required".
Resources to enforce
How: A checkbox group — Channels, Posts, Teams. Default: Channels.
Help text: "Choose which resource types require classification for access decisions."
Behavior: Checking a resource automatically adds it to the "Apply classification markings to" section and locks it there ("Required for enforcement"). Unchecking removes the lock but keeps the resource applied, so its display settings are preserved.
Clearance mapping in the Classification levels table
When enforcement is on and a clearance attribute is selected, the Classification levels table gains a mapping column. The panel subtitle updates to reflect it (e.g., "Text, colors, and Clearance mapping for classification levels.").
Element | Description |
|---|---|
Column header | The selected attribute's name (e.g., "Clearance"). |
Per-row dropdown | Selects the clearance value required for that classification level. Options: "Clearance not required", followed by the attribute's ranked values. |
Behavior:
Auto-map by rank: When an attribute is selected (or created), each classification level is mapped to the attribute value with the same rank. Levels with no matching rank default to "Clearance not required". In the default US preset example, UNCLASSIFIED and CUI map to "Clearance not required" while CONFIDENTIAL through TOP SECRET//SCI map to their same-named clearance values.
Manual override: The admin can change any row's mapping. Manual edits are preserved until the levels or attribute change in a way that re-syncs the map.
Re-sync: Adding, deleting, or reordering levels (and changing preset or attribute) re-derives ranks and re-syncs the mapping by rank.
Hidden when inapplicable: The column is absent when enforcement is off or no attribute is selected.
Enforcement controls: Apply classification markings to
A section at the bottom of the page defining which resources carry classification markings, and the required/display rules for each. Section subtitle: "Choose which resources can carry classification markings, and configure required and display settings for each."
Each applied resource renders as a card:
Element | Description |
|---|---|
Card header | Resource name (Channels, Posts, or Teams). Enforced resources show a "Required for enforcement" hint and cannot be removed; non-enforced resources show a remove (×) button instead. |
Required | True/False radios. Help text: "When true, a classification value must be set on this resource." |
Display | Checkboxes for where markings appear on that resource. Channels and Teams: Header, Sidebar, Banner. Posts: Composer, Message. |
Below the cards, an "+ Add resource" button opens a menu of resource types not yet applied; the button hides once all resource types are applied.
Defaults: Channels is applied by default (Required: True; Display: Header + Banner). Posts defaults to Required: True with Composer + Message; Teams defaults to Required: False with Header.
Behavior summary
Action | Result |
|---|---|
Set "Enforce classification markings" to True | Clearance attribute and Resources to enforce settings appear; mapping column appears once an attribute is selected; enforced resources lock in the Apply section. |
Set "Enforce classification markings" to False | Dependent settings hide; mapping column is removed; Apply cards unlock. Configuration is retained for re-enabling. |
Select a clearance attribute | Attribute values auto-map to classification levels by rank; unmatched levels map to "Clearance not required". |
Create a ranked attribute from levels | New attribute is created from the selected levels, auto-selected, and auto-mapped. Excluded levels map to "Clearance not required". |
Add / delete / reorder classification levels | Ranks re-derive from row order and the clearance mapping re-syncs by rank. |
Check a resource under "Resources to enforce" | The resource is added to "Apply classification markings to" (if absent) and locked as "Required for enforcement". |
Uncheck an enforced resource | The resource stays in the Apply section with settings intact, but becomes removable. |
Edge cases
No ranked attributes: The Clearance attribute control renders the empty state described above; enforcement cannot be completed until an attribute is created or added.
Levels mapped to "Clearance not required": Resources marked at these levels are not gated by clearance, even while enforcement is on. This is the expected configuration for the lowest tiers (e.g., UNCLASSIFIED).
Attribute values that don't match any level rank: They remain available for manual per-level mapping but are not auto-assigned.
Out of scope
The Membership policy management surface that administers the resulting access rules (linked from the Enforce help text) is specified separately.
Banner/label rendering, channel-level configuration, presets, and reclassification rules — unchanged from UX Spec: Classification Markings.
Resources
UX Spec: Classification Markings (original spec this one extends)