Handling Information: Classification by Sensitivity, and Provenance

Classification says how sensitive a document is and therefore who may see it, where it may sit and whether it may be quoted. Provenance says where the document came from and through how many hands. The two are separate questions, and both must be recorded on arrival. Neither can be reconstructed afterwards from the file itself.

Both are hard for one reason. A document arrives carrying no label. Nothing inside a spreadsheet says who supplied it, nothing in it says whether the desk was free to reproduce it, and nothing in it says whether what has arrived is the original or a copy of a copy of a copy. The supplier, the permission and the number of copies exist only in the moment the document lands on the desk, and they are gone within a week unless somebody writes them down. Every rule below exists because the arrival moment is the only moment when the truth about a document is still cheap to capture.

One assignment carries every example below. The Kavery research desk, four people inside Kavery Capital Services Private Limited, an invented lender, was asked a question about Meenakshi Tubes Private Limited, an invented borrower the desk already lends to. Sharada Iyer produced the work, Prakash Nadar reviewed it, and Latha Menon commissioned it and made the decision at the end. The file was opened on 3 March, delivered on 11 March and decided on 12 March.

The borrower's product is irrelevant to every rule below, and the irrelevance is the point rather than an accident. Handling rules attach to the document rather than to the subject the document happens to describe. Substitute a bond issue, a fund, a warehouse or a single machine for Meenakshi Tubes Private Limited and every rule below still stands. The source log, and the ranking that fills it, is set out under evidence in finance work. Classification and provenance are the two columns that log does not carry, and one missing column cost this working file a wrong revenue figure.

What does classifying a document actually decide?

ClassificationThe sensitivity level a document is given, which decides how it may be handled. sounds like filing and is actually permission. Giving a document a level is not a description of how secret it feels; it is a decision about four concrete things, all settled at once and all enforceable by somebody who was not there when the document arrived. Where the document may sit. Who may open it. Whether any part of it may be reproduced. And what happens to it when the assignment closes.

Everybody has already done this without naming it. Think about a household for a second. The electricity bill sits on the kitchen counter and anybody who visits can read it. The salary slip goes in a drawer and only two people open that drawer. The letter from the hospital about a relative goes in a place only one person knows, it is never read aloud, and when the matter is over it is either given back or torn up. Nobody in that household wrote a policy. The household still ran three levels, and the three levels decided storage, access, repetition and disposal in exactly that order. A desk has more documents than a kitchen counter and more people than a household, so a working file does the same thing on purpose and in writing.

Three levels are enough. Two collapse the difference between something a client sent over and something the desk promised in writing to handle in a particular way, and that difference is the one that matters most. Four or more sound thorough and then get ignored. A person holding a spreadsheet at half past six in the evening will not choose between five shades of sensitivity. The levels below run public, then confidential, then one tighter than either.

Level one, public: what may anybody see, and why log it at all?

Public means the document is available to anybody who goes and looks. A filed statement on a public registry, a stock exchange listing, a published methodology, a printed article. Nobody gave it over in confidence. Nobody had to give it over at all. Public material may sit in any working folder, may be opened by anybody, and may be quoted in full with its item number beside it.

So why record it? Because public says nothing about where a particular copy came from, and that copy is the one that will actually be used. Where a particular copy came from is the second axis, provenance, and it is the harder of the two. Four of the twelve public documents on this file could not be traced to an origin at all. Losing the origin did not make them secret, and it did make two of them wrong.

Level two, confidential: what does supplied for this work only mean?

Confidential means somebody handed it over for this assignment and would not have handed it to a stranger. Management accounts, an internal schedule, a customer list, a price sheet. There is no drama in it. Confidential material exists in the world but was routed to one recipient personally, and the routing carries a condition even when nobody spelled the condition out.

The handling rule is the useful part. Confidential material may be used in aggregateCombined with other figures so that no single supplied number is visible. and may not be reproduced line by line. The note may say that input cost per unit rose across the year. The note may not print the price sheet, and it may not print one price from it. The conclusion drawn is the analyst's to publish; the material it was drawn from is not. The split between the conclusion and the material resolves about nine out of ten confidential-handling arguments before they start, and it is worth memorising in exactly that form.

Level three, restricted: what does received under an undertaking change?

RestrictedReceived under an undertaking; it may inform a conclusion but never appear in one. means the document arrived attached to a written promise about how it would be handled. An undertakingA written promise about how received material will be handled. is not a mood, it is a document with named people in it, and the names in it are the complete list of people who may open the thing. Three documents on this file were restricted for exactly that reason.

The handling rule at this level is stricter than the confidential one and it is stricter in a specific direction. Restricted material may inform a conclusion and may never appear inside one. Not quoted, not paraphrased closely enough to be recognised, not summarised in a way that reproduces its shape. Restricted material is allowed to change what the analyst thinks. Restricted material is not allowed to leave the file. The moment the rule becomes a judgement, the useful sentence always wins the argument, so the rule is written mechanically instead.

What may be quoted, what may only inform, and how far apart are those?

Permission is what is actually needed at the moment of writing a sentence, so the three levels are easiest to hold in the head as three permissions rather than three degrees of secrecy. Public material may be reproduced. Confidential material may be used in aggregate. Restricted material may only inform. Reproduce, aggregate and inform are three different verbs, and the third one is the one people break. Correct handling of restricted material is the only kind that produces nothing visible in the note.

The third verb deserves a moment. When public material is used well, the note gets a quotation and a source line, and the care taken is visible. When confidential material is used well, the note gets a sentence about direction rather than level, and the care is at least half visible. When restricted material is used well, the note contains nothing at all from it. The only trace is a question that would not otherwise have been asked. There is no reward signal. The rule therefore has to be mechanical rather than a matter of good intentions.

Who sets the level, and does the supplier get the last word?

Somebody hands over a document and says it is public. Does that settle it? No, and the reason is worth understanding rather than memorising. The person who supplies a document states what they intended. The person who receives it sets the level, and only the receiver knows what else is in the file and who is going to read the file.

Sensitivity is not a property of a document in isolation. Sensitivity is a property of a document sitting next to the other documents on the file. A published volume series is public on its own. Put it beside a confidential schedule and the two together may let a reader work out something neither one discloses, and now the working copy of the public series sits inside a folder that has become more sensitive than any single sheet in it. Combination is the whole reason the receiver decides.

Here is the household version. A photograph of a house is not sensitive. A note of when the household is away is not sensitive on its own either. Half the street knows. Putting the two in one envelope makes something neither document was. Nobody had to change either document to do it.

Two practical consequences follow. First, a supplier may raise a level and may not lower one. If somebody sends material marked confidential, it stays confidential even when the same document sits on a public website. The marking is what was accepted when the material was taken. Second, the level is written down by the receiver on arrival, with the receiver named. A person reading the file later then knows whose judgement it was rather than having to guess at it.

What Is Data Provenance, and Why Is It a Separate Question from Sensitivity?

ProvenanceWhere a document came from and every hand it passed through on the way. is where a document came from and every hand it passed through on the way. Sensitivity asks who may see this. Provenance asks where did this come from. Who may see this and where did this come from are genuinely different questions, they have different answers, and a file that records one and not the other is only half a file.

The clearest way to see that they are independent is to notice that all four combinations exist and all four are commonly met. A public document with perfect provenance: a filing downloaded from the registry this morning by the person using it. A public document with terrible provenance: a spreadsheet forwarded by somebody who got it from somebody else who got it out of something. A restricted document with perfect provenance: it arrived attached to a named undertaking on a stated date from a stated person, and the undertaking is precisely why it is restricted. And a restricted document with poor provenance. The fourth combination should stop the work cold: if nobody can say where the document came from, nobody can say whose undertaking it fell under.

On this working file the two axes came apart very visibly. The file held 21 documents. Twelve were public, six were confidential because the client supplied them, and three were restricted because they arrived under a written undertaking. Every one of the six confidential and all three of the restricted documents had a recorded origin. The act of accepting them created a record. Four of the twelve public ones had no traceable origin at all. The least sensitive shelf in the file was also the worst documented shelf in the file, and that is not a coincidence but a consequence: nobody feels careful about something anybody could have fetched.

Which four fields go on the arrival record, and when?

An arrival record is four fields wide and takes about fifteen seconds. Level, origin, date received and route. The record is written at the moment the document lands, before it is opened properly and before anybody knows whether it will matter. Whether it will matter cannot be known yet, and the cost of writing four fields is fifteen seconds.

Level is the receiver's decision, with the receiver's name on it. Origin is the body, website or person the document ultimately came from, and the honest entry when the origin is unknown is not established rather than a guess. Date received is the day it arrived. The day it arrived is not the same as the date printed on the document, and the difference between the two is frequently the story. Route is the one people skip, and it is the one that earns its keep.

Route means how it arrived, in hops. Downloaded from the registry by the person using it. Emailed by the finance head on 10 March. Forwarded by a colleague, who had it forwarded to them. Route is the only field that can reveal an extract of an extract, and it is the only one of the four that is completely unrecoverable a week later. Route lived in a covering email nobody kept.

What does a document lose at each hop?

A document does not degrade all at once. A document loses something specific at each pass, and the order is fairly reliable. The number of hands a document has been through can often be guessed from what is missing off it. The link goes first, then the date, then the version, and only at the end does the figure itself start to drift.

Hop one, somebody saves the filing as a spreadsheet and emails it. The document is intact and the link back to the source is gone. Hop two, the person who received it forwards it on and trims the covering note, so the date it was pulled disappears with the note. Hop three, somebody reformats it into a summary tab because the original had columns nobody needed. Now the version is gone. Reformatting means somebody selected, retyped or rounded something, and reformatting is where numbers start to move.

The third hop is the dangerous one, and it is dangerous in a very specific way. Nobody is careless at hop three. Somebody is being helpful: tidying a messy sheet so that colleagues can read it. Helpfulness is what puts a hand on the numbers, and a hand on the numbers is what produces a figure that is nearly right.

What did an extract of an extract cost on this file?

Here is what actually happened, and it is worth walking slowly because the numbers are small and the consequence is not. Four of the twelve public documents arrived as forwarded attachments with no traceable origin. When Sharada Iyer went back through them, two of those four turned out to be an extract of an extract. One of those two carried revenue of Rs 20,90,00,000 for the year just reported. The filed accounts carry Rs 21,20,00,000.

The gap is Rs 30,00,000. Against the filed figure that is 1.4 per cent, or 1.42 per cent taken to two places. Said out loud, it sounds like nothing. A gap of Rs 30,00,000 looks like a rounding convention, or a difference between two definitions of revenue, or the sort of thing that gets waved through with a shrug because it cannot possibly matter at that size. A wrong figure that is obviously wrong gets caught in the first minute. A wrong figure that is 1.4 per cent out has the texture of a right one, and gets adopted.

Where that figure was going to sit is the point. Operating profit for the year just reported is Rs 2,30,00,000, and the margin is that divided by revenue. Dividing by the filed Rs 21,20,00,000 gives 10.8 per cent. Dividing by the extract figure of Rs 20,90,00,000 gives 11.0 per cent. The credit policy of the desk, an invented internal policy rather than a rule of Indian lending, sets an internal floor at 11 per cent.

A 1.4 per cent error in one input moved the answer by 0.16 of a percentage point, and 0.16 of a percentage point was the entire distance between clearly below the floor and sitting on it. The distance to the floor is the whole lesson of provenance in one line. The size of an error settles nothing on its own; what matters is whether it crosses something somebody will act on.

Two things were then done, and the second one is the one people skip. The filing won. A filed statement sits above a forwarded extract on any source ladder worth having, and the ladder was fixed before anybody knew which document would turn out to be inconvenient. And the extract was not deleted. The extract stayed in the working file marked supersededKept in the file but marked as beaten by a better item., with the arrival record beside it showing the three hops. Anybody rereading the file six months later can now see that the disagreement was found rather than never noticed, and can see why it existed.

What happens to all of it when the assignment closes?

An assignment ends and the file goes quiet, and quiet is where handling rules die. DispositionWhat happens to each document once the assignment closes. is the last field on the record, and it is the only step that happens after everybody has stopped paying attention. Disposition is therefore what separates a working practice from a good intention.

Three outcomes cover almost everything. Public material is kept, along with the whole workpaper, and six months later somebody has to be able to rebuild the conclusion. Confidential material is returned or held on stated terms, on whatever basis the supplier set at the start. Restricted material is handled as the undertaking says, whether that means returned, destroyed or held for a stated period.

The common failure is not destruction of something that should have been kept; it is quiet retention of something that should have gone. Nobody decides to keep the restricted schedule. The schedule simply stays in a folder because it might be useful later, the undertaking lapses, and two years on there is material sitting on a drive that nobody has a right to hold and nobody remembers accepting. The fix is the same at every step: write the line, date it, name the person. A disposition that was carried out and not recorded is indistinguishable, later, from one that never happened.

How does a lender, an analyst or somebody working alone use any of this?

A lender receiving a file from a borrower or a broker reads the provenance column first, not the conclusion. The reason is practical rather than suspicious: a lender cannot re-do the work, so the only thing available is a judgement about how much of the file is first hand. A file where most items were fetched directly can be argued with on the merits. A file that is mostly forwarded attachments has to be treated as a set of claims, whatever the quality of the reasoning on top. The reasoning cannot be better than the inputs, and the inputs cannot be checked.

An analyst uses the levels while writing rather than while reading, and the payoff is speed. If every item carries its level, what may go into the note has already been answered before the writing starts. Answering it that early removes the single most common source of late-stage rework. Discovering at the final read that a paragraph rests on confidential material means rewriting the paragraph on a deadline. A deadline is exactly when a person is most likely to talk themselves into keeping it.

Somebody working alone gets the most out of this and usually does the least. There is no colleague to notice that a spreadsheet arrived from nowhere, so the arrival record is the only reviewer available. Writing four fields at the door forces the one question a solitary worker never otherwise asks: where exactly did this come from? A household running the same discipline on a property purchase would keep three piles: the documents anybody could have fetched, the ones the seller supplied and would not have supplied to a stranger, and the ones handed over on a promise. Three piles, a line written on each as it arrives, and a note at the end of what happened to each. Three piles are the same practice a desk of four people runs, at a different scale.

One last test is worth saying plainly, and it is the practical test of whether any of this worked. Six months after this file closed, a different person on the desk rebuilt the 10.8 per cent figure from the workpaper without asking anybody, and it took 25 minutes. A cold rebuild is the only real proof a working file holds up. Not that it looks tidy, and not that somebody signed it, but that a stranger can walk into it cold and get back to the same number.

Kavery Capital Services Private Limited, the Kavery research desk, Meenakshi Tubes Private Limited, Sharada Iyer, Prakash Nadar and Latha Menon are invented.
Educational material. Not advice on any investment, tax, budget or market position.