Labels and information flow

Syderial checks clearance before a question reaches the record. A model never sees a line the caller isn’t cleared for, so there’s nothing to filter out of an answer afterwards.

Labels

Every line in the record has a label, and every request has a clearance with the same five axes.

Axis	Meaning	Rule
boundary	The part of the organization the line belongs to, from a tree your organization manages.	The reader’s boundary must contain the line’s.
sensitivity	How widely the line may travel, as a ladder of ranks your organization names.	The reader’s rank must be at or above the line’s.
compartments	Need-to-know groups within a boundary.	The reader must belong to every compartment the line is in.
integrity	How well the evidence supports the line, from unverified to proven.	The line must meet the floor the request sets.
purpose	The uses the line is permitted for.	The request’s purpose must be one the line allows.

Dominance

A line reaches a reader only when the reader’s clearance dominates the line’s label on every axis. Dominance is a partial order. One clearance can dominate many labels, and two labels can be incomparable.

axisline labelreader clearancecheck

boundaryoperations / plant-2operationswithin: yes

sensitivityrank 2rank 3at or above: yes

compartmentsmaintenancemaintenance, safetycontains: yes

integrityattestedfloor: inferredmeets floor: yes

purposeoperationsauditcontains: no

ResultThe line doesn't reach this reader. Four axes pass and purpose fails, and one failed axis is enough.

Figure 1. Syderial checks dominance on every axis. A line reaches a reader only when the reader's clearance dominates its label on all five.

Three rules follow from dominance.

• Anything built from several lines gets the strictest of their labels.
• No operation lowers a label.
• A request can narrow its clearance and can’t widen it. Clearance comes from the credential and the permissions it maps to.

Refusal and absence

A question can end in four ways, and Syderial answers each one differently.

Case	What you get
The record has it and you’re cleared.	The answer with its evidence.
The record has it and you aren’t cleared.	A refusal that names no one and reveals nothing about the withheld lines.
The record doesn’t have it.	An honest absence. The door says the record has nothing on the question.
A service failed.	An error. The door doesn’t answer from partial context.

Tool calls

A tool call has a label too. Before a tool runs, the caller’s clearance and the tool’s own reach must both dominate the request. A tool with no declared reach doesn’t run. The Gate station applies this rule.

Available to design partners as it ships.

Further reading

Boundary-First Information Governance is the architecture note behind this model.