Ada Security
Request Demo

8.2 Label order: the sensitivity ladder

The order of the cards is the most important setting on this page. It is not cosmetic. Endpoints never compare label names. They compare each label’s position.

8.2.1 Top is lowest, bottom is highest

  • The top card is the least sensitive label (for example Public).
  • The bottom card is the most sensitive label (for example Strictly Confidential).
  • Internally each label has an order number, an integer of 1 or more that must be unique. A higher number means more sensitive. The console keeps these numbers for you; you only use ▲ and ▼.
  • An unlabeled document counts as position 0, below every label. Any label is therefore an upgrade from “no label”.

8.2.2 What the order decides

Area How the order is used Example (Public < Internal < Confidential < Strictly Confidential)
Label pickers Every picker (Office add-ins on Windows, the right-click tool, the macOS agent and the Office web panels) lists the enabled labels top to bottom in this order. Users see Public first and Strictly Confidential last.
Downgrade detection Choosing a label higher in the list (lower position) than the current label is a downgrade. The current label’s Justification required on downgrade and Downgrade not allowed settings then apply, and the change is logged as Label downgraded instead of Label applied. Confidential → Internal is a downgrade. Internal → Confidential is not.
Recommendation from several rules When several Recommend rules match the same content, the endpoint recommends the highest of their labels. One rule recommends Internal and another Confidential. Confidential is recommended.
Enforce rules When several Enforce rules match, the label of the highest one is required exactly. A lower current label is upgraded automatically. A different label at the same or a higher position is refused. An IBAN rule enforces Confidential. A document labeled Internal is raised to Confidential.
Manual choice versus content In the picker, a label below the position required by an Enforce rule cannot be applied. The user gets a “requires at least …” message. The user picks Internal for a document that must be Confidential. The choice is refused.
File agent The agent only raises labels. It applies an Enforce result when it is higher than the current label. It lists a Recommend result as a pending recommendation when it is higher than the current label. It never lowers a label. A file labeled Strictly Confidential that matches a Confidential rule is left alone.
Folder (bulk) labeling Labeling a folder only labels files that are unlabeled or carry a lower label. Files with a higher label keep it. Labeling a share Internal leaves its Confidential files untouched.
Email attachments With Check attachment labels on, sending is blocked when an attachment’s label is higher than the email’s label. With Label from attachments on, the email label is raised to the highest attachment label when a document is attached (raise only). Both are in Policy → Rules → General Enforcement (section 10.5). An Internal email with a Confidential attachment is raised to Confidential, or blocked.
Outlook (recipient-domain) rules A mail rule’s label is a minimum, not a maximum. If the content recommends a higher label, the user is asked. If an Enforce rule requires a higher label, the mail rule is skipped. A mail rule applies Internal to contoso.com, but the message contains card numbers (Confidential). The user is asked.
Default label Default label (General Enforcement) is pre-selected in the picker only when nothing higher is suggested. On send, the highest of the content recommendation, the top attachment label and the default label wins. Default label is Internal and a rule recommends Confidential. Confidential is pre-selected.
Labels from other products If a document carries several foreign labels that map to different Ada labels, the highest Ada label wins. A Purview label maps to Internal and a Titus property maps to Confidential. The document counts as Confidential.

8.2.3 Reordering labels

  1. In Policy → Labels, find the label you want to move.
  2. Click ▲ to make it less sensitive or ▼ to make it more sensitive. Each click swaps the label with its neighbour.
  3. Confirm the dialog: You are about to swap the order of the labels “A” and “B”. This changes the labels’ sensitivity order (affects downgrade, attachment baseline, and class comparisons). Continue? Click Cancel to leave the order unchanged.
  4. Repeat until the label is where you want it. Each step asks for confirmation.
  5. Click Publish & Sign. The publish record in the Audit Log lists both swapped labels as Label edited.

8.2.4 What happens to existing documents when the order changes

Documents store the label ID, not its position. After you reorder:

  • No document changes on disk. Every document keeps its label and markings.
  • The meaning of the stored label changes. From the next sync, every downgrade check, rule comparison and attachment comparison uses the new positions.
  • The file agent re-evaluates files. On Windows and macOS the agent fingerprints the rules together with each label’s ID, position and enabled state. A change in label order therefore makes it re-evaluate the files in the watched folders. Files whose rule result is now higher than their current label become pending recommendations, or are upgraded automatically if an Enforce rule applies. Files are never downgraded. On large profiles expect a burst of scanning and, possibly, new recommendations.
  • Open documents pick up the new order when the add-in next reads the policy. The new comparison applies at the next labeling, save or send.

8.2.5 Worked examples

Example 1: swapping two middle labels. The ladder is Public (1), Internal (2), Confidential (3), Strictly Confidential (4). You click ▲ on Confidential and confirm. The ladder becomes Public, Confidential, Internal, Strictly Confidential. Now:

  • a user who changes a document from Internal to Confidential is downgrading. If Internal has Justification required on downgrade, they must type a reason;
  • a rule that recommends Internal now beats a rule that recommends Confidential;
  • an Internal attachment on a Confidential email blocks the send (with Check attachment labels on).

This is almost never what you want. It shows why order must reflect real sensitivity.

Example 2: adding a label in the middle. You need Restricted between Internal and Confidential.

  1. Click + Add Label, fill it in and click Save. Restricted appears at the bottom, above nothing, so it is now the most sensitive label.
  2. Click ▲ on Restricted and confirm. It now sits above Strictly Confidential.
  3. Click ▲ again and confirm. It now sits above Confidential.
  4. Publish. The ladder is Public, Internal, Restricted, Confidential, Strictly Confidential.

Example 3: the downgrade rule reads the label being left. Confidential has Downgrade not allowed. Internal has nothing. A user can move a document from Internal up to Confidential. Once it is Confidential, nobody can move it back to Internal or Public, not even with a justification. Moving it up to Strictly Confidential is still allowed.

8.2.6 Sub-sensitivity order

Sub-sensitivities have no position of their own. They share the parent label’s position.

  • Changing Confidential  HR to Confidential  Finance is not a downgrade.
  • Pickers list sub-sensitivities in the order you added them. The drawer has no reorder control. To change the order, remove a sub-sensitivity and add it again. The new entry gets a new ID, so see the warning in section 8.5 first.