Stratum

Stratum is the file-governing module introduced in v1.4. It classifies documents into Confidential / Internal / General grades, produces a masked copy with sensitive items redacted where needed, and acts as the control layer that lets only cleared documents leave for external generative AI (external transfer). Just as Guardian governs text input, Stratum governs files — and the two coexist inside one project as peer Module Instances. Stratum is made up of two capabilities:

​

How it relates to Guardian

Guardian and Stratum are separate modules that never call each other. When a project runs both, responsibility splits by input type — text goes to Guardian, files go to Stratum alone — and their results are never cross-combined into one verdict. Stratum handles both grade classification and masking for files, and Guardian’s file guardrails don’t apply there. A project without Stratum keeps the existing behavior: Guardian handles both text and files. Where Guardian decides an action — content filtering as PASS / MASK / BLOCK — Stratum assigns the document itself a grade. It normalizes diverse document formats (word processors, presentations, PDF, HWP/HWPX, and more) and contents (images, tables, formulas) into a standard representation before classifying, so classification quality stays consistent across document types.

​

Taxonomy — the grading scheme

Stratum’s grading scheme is defined in an artifact called the Taxonomy. It holds the grade set, each grade’s rank, its verdict method, and thresholds. Because the number of grades, their names, and their criteria vary by customer, the grading scheme is split into its own artifact so classification rules can reference grades abstractly. As of v1.4 there are three grades: When one document produces signals for multiple grades, it’s finalized at the highest grade (highest-rank). A single sensitive section pulls the whole document’s grade up, preventing under-classification. A manually assigned grade is never silently overwritten by automatic classification. The Taxonomy is a separate artifact with its own versions, distinct from the Rule Package; a Rule Package references a specific Taxonomy version. Taxonomies are relatively stable, so several Rule Package versions typically reuse one.

​

The classification pipeline — the L1–L4 cascade

Stratum gathers signals through a cascade of stages, each heavier and more precise than the last: When an early stage finalizes a high-confidence signal, the cascade exits early; only boundary cases escalate to later stages. L4’s judgment only ever acts as a “needs review” signal — it never directly blocks or masks on its own. Every verdict comes with evidence — the detection layer, the detector, the contributing grade, confidence, a masked preview, and a per-detection maskable flag — which becomes the basis for review and audit.

​

Masking and re-grading

Stratum redacts the maskable detections to produce a masked document, re-classifies that masked copy, and takes its grade as the final basis for external transfer. If masking removes the sensitive content and the grade drops, external transfer opens up. Detections split into maskable and non-maskable. A document containing non-maskable items — credentials and the like, where risk remains even when redacted — keeps its grade and stays blocked from external transfer. Which items get masked is decided by each detection’s maskable flag and the Rule Package’s policy, so how far masking can lower a grade depends on your policy and Taxonomy configuration.

​

Three routing outcomes, and fail-secure

Grade classification routes external transfer down one of three paths: A planned absence and an accidental outage are handled differently:

• A project with no Stratum at all — files go through Guardian guardrails only, as before (existing behavior preserved).
• Stratum is deployed but temporarily unavailable (outage, timeout) — fail-secure: external transfer is blocked by default.
• A Stratum instance exists but no Rule Package is pinned — files pass through without any classification. This mirrors Guardian passing traffic uninspected when no policy is assigned; pin a Rule Package to start classifying.

​

Secondary review — gray-zone classification and Confidential re-review

Gray-zone and Confidential documents get a final call from a human. The two flows differ in character: Both flows are block first, approve after: the moment a gray-zone or Confidential verdict lands, that file’s external transfer is held, and it doesn’t open until a person approves. There’s no “conditionally pass, then review” path — fail-secure holds. Rather than re-reading the whole document, reviewers judge from the masked copy and the evidence first — detected patterns, locations, pages, contributing grades, confidence. The approved final grade takes effect in external-transfer routing immediately and lands in the audit record along with the approver and rationale.

​

Two ingress paths — inline synchronous, and submit-and-poll asynchronous

Stratum is invoked over two paths, and both share the same policy (Taxonomy · Rule Package):

​

Learn more