Guided defense lab

Information Flow Control

A guided exercise on source-to-sink information-flow decisions: classification and lineage versus model claims, access versus authorization versus reachability versus flow, conservative joins for mixed sources, no model self-declassification and explicit trusted release.

Conceptual simulationAdvanced15 minutes2026-09-27

Conceptual simulation

This exercise uses authored, deterministic examples with fictional names, .example.test destinations and neutral synthetic content. It calls no tools, APIs, agents or models, and it does not predict how any real model or system behaves.

Step 3 of 63/6

Learning objectives

Separate data access, action authorization, network reachability and information-flow permission.
Base flow decisions on source classification, lineage, sink attributes and the current policy version.
Propagate labels to derived artifacts with a conservative join for mixed sources.
Keep all relevant contributors of a mixed-source output instead of trusting a primary citation or rank.
Reject model-authored classification or declassification claims.
Recognize explicit trusted declassification as a recorded event that produces a new artifact with lineage.
Treat unknown attributes as explicit values that fail closed where policy requires it.
Explain why flow permission is neither a trust verdict nor action permission.

Prerequisites

Information Flow Control defense article (recommended)
Data Provenance lab (recommended)

Choose a scenario

Each fictional scenario shows content and model text and, separately, the application-owned facts about sources, lineage, sinks and policy. You judge whether this data may move to this sink - not whether an action may execute and not whether a destination is reachable.

Public data to the same user's answerPublic product-manual excerpt P-18 is retrieved for tenant tn-4 and used in an answer returned to the same authenticated user.Restricted data to external emailA support workflow legitimately reads internal-restricted procedure KB-77. A send to partner@external.example.test is action-authorized for this workflow, and the email gateway is reachable. The body is derived from KB-77, with no declassification event.Mixed-source summary labeled too lowSummary S-52 combines public document PUB-4 and restricted customer record CR-9. A candidate envelope labels S-52 public because the summarizer picked PUB-4 as its primary citation. The target sink is a public help page.Model self-declassificationA model summarizes restricted source R-33 and writes that the summary is safe for external sharing. No trusted redaction component or reviewer event is recorded. The sink is the external webhook https://receiver.example.test/callback.Trusted declassification artifactRestricted record R-41 is processed by deterministic release pipeline release-redactor-2 under policy release-v5, producing artifact REL-41. The target is the approved documentation sink docs.partner.example.test. The publish action is assumed separately authorized; only the data flow is judged.

Source-to-sink path

Data leaves a source with application-owned provenance and classification, may be transformed into derived text and is proposed for a sink. An IFC policy decides the flow and an enforcement point applies it. Content and derived text stay variable.

Source with application provenance and classificationApplication-owned->
Source contentVariable content->
Transformation and derived contentVariable content->
Application-resolved sink attributesApplication-owned->
IFC policy decisionApplication-owned->
Enforcement pointApplication-owned

Content and model text

What the data says or what a model writes about it. It cannot change classification.

Retrieved excerpt P-18
Synthetic manual text: how to reset the demo device to factory settings.
Retriever note
Top result, relevance 0.94.

Application-owned flow facts

Source classification and lineage, principal and tenant, sink attributes, policy version and recorded declassification events. Access, authorization and egress results are shown where relevant but decide other questions.

Source: P-18 v2, classification public, tenant tn-4
Principal: authenticated user u-44, tenant tn-4
Sink: user-answer/session-44, tenant tn-4, class user-facing same-tenant
Lineage and policy: answer derived only from P-18 v2; no restricted constituent; policy flow-v4