Data classification labels

# data-inventory.yml

identities:
  fields:
    email:
      classification: PII
      retention: lifetime + 30 days
      encrypted: false  # used for lookup
    password_hash:
      classification: SECRET
      retention: lifetime
      encrypted: bcrypt/argon2
    first_name:
      classification: PII
      retention: lifetime
    phone:
      classification: PII
      retention: lifetime
      encrypted: at-rest

security_audit:
  fields:
    identity_id:
      classification: PII
      retention: 90 days, then anonymize
    source_ip:
      classification: PII
      retention: 90 days
    metadata:
      classification: variable

user_profiles:
  fields:
    bio:
      classification: internal (user-provided)
      retention: lifetime
    medical_history:
      classification: SENSITIVE_PII
      retention: per regulation
      encrypted: per-user key

classification:
  PII:
    access:
      - role: admin
      - role: customer (their own)
      - role: support (with reason)
    audit_log: true
    retention: max 7 years
    encryption: at-rest
  
  SENSITIVE_PII:
    access:
      - role: admin (with separate elevation)
    audit_log: true (extensive)
    retention: per regulation
    encryption: per-user key
  
  SECRET:
    access:
      - never raw (only validate hashes)
    audit_log: only access events
    retention: rotation cycle
    encryption: never store plaintext

@Classification(["PII"])
class Identity {
  @Field({ classification: "PII" })
  email: string;
  
  @Field({ classification: "SECRET" })
  password_hash: string;
  
  @Field({ classification: "SENSITIVE_PII" })
  medical_history: string;
}

// Detected: returning SENSITIVE_PII without proper authz
function getUser() {
  return await db`SELECT * FROM users`;  // ⚠️ returns SENSITIVE_PII fields
}

function canAccessField(user, field) {
  const fieldClass = getFieldClassification(field);
  return hasPermissionForClass(user, fieldClass);
}