---
title: File Classification
description: Set department security policies and file or folder levels to control visibility, sharing approvals and file operations for existing and newly uploaded files.
slug: file-classification
lang: en
category: Product Features
category_order: 2
order: 15
keywords:
  - File classification
  - Folder classification
  - Security level
  - Department security policy
  - Open
  - Internal
  - Restricted
  - Confidential
  - Top-secret
  - Security officer
  - Sharing approval
---

# File Classification

BabelBird uses file classifications to apply confidentiality requirements to visibility, sharing, approval and file operations. An enterprise can set a security policy for an entire department or assign a security level to an individual file or folder.

**Setting a department security policy automatically applies the corresponding classification to its existing files and to subsequent uploads.** For example, the Confidential department policy gives Finance files the Restricted classification, without requiring each new upload to be classified separately.

The **Security level** field in file details offers **Open, Internal, Restricted and Confidential**. These are security controls within BabelBird, not merely display labels. They work alongside roles, file access controls and sharing settings.

## Department Policies and File Levels {#policy-mapping}

Department policy names and file-level names are different. The English file-details panel calls the highest file level **Confidential**, while the department policy table calls that level **Top-secret**. Both correspond to the Chinese file level 绝密. By contrast, the department policy named **Confidential** corresponds to 保密 and assigns files the **Restricted** level.

| Department policy | Corresponding file level in file details | Applies to |
| --- | --- | --- |
| Open (公开) | Open (公开) | Existing department files and subsequent uploads |
| Ordinary (普通) | Internal (内部) | Existing department files and subsequent uploads |
| Confidential (保密) | Restricted (限制) | Existing department files and subsequent uploads |
| Top-secret (绝密) | Confidential (绝密); shown as Top-secret in the policy table | Existing department files and subsequent uploads |

**Open does not mean publicly accessible on the internet.** This classification does not grant access to everyone or automatically create a share link. Department roles, file permissions, sharing scope and enterprise external-sharing controls still apply.

## Set a Department Policy {#department-policy}

1. A user with the **security officer** role opens **Enterprise Console > Organization** and selects the department. Department information can also be viewed from department management in Enterprise Files.
2. Locate **Department file security strategy** or **Enterprise file security strategy**. Use the explanation link to review the rules.
3. Open **Edit** and set the department policy.
4. Save the policy. Existing files receive the corresponding classification, and subsequent uploads use it too.
5. Check visibility, sharing approval and download behavior with member accounts that have different roles.

![Department management with its security strategy and Edit entry](../../assets/images/file-classification-department-en-20261113.png)
*Department information shows the active strategy. In this example it inherits the security policy of the parent department; check the parent's effective policy when determining the corresponding file level.*

Only the **security officer** can set the overall enterprise or department security policy. The policy table also uses the label **Security Keeper** for this role. Department-management or approval authority alone does not imply authority to configure the overall policy.

### Department Approval Rules {#department-approvals}

| Department policy | Default file level | Members initiate sharing | Members join shares or projects | Members send files | Approver |
| --- | --- | --- | --- | --- | --- |
| Top-secret | Confidential / Top-secret | Approval required | Approval required | Approval required | Security officer or super administrator |
| Confidential | Restricted | Approval required | No approval required | No approval required | Supervisor |
| Ordinary | Internal | Approval required when sharing outside the department | No approval required | No approval required | Supervisor |
| Open | Open | No approval required | No approval required | No approval required | None |

![Enterprise file security strategy and approval rules](../../assets/images/file-classification-policy-rules-en-20261113.png)
*Department policies govern default file classifications and approval requirements for sharing, collaboration membership and sending files.*

Additional rules also apply:

- A security officer can approve all sharing requests.
- Inviting people from a Confidential department to a share or project requires approval from a security officer or super administrator. Check recipient-side restrictions as well as the initiator's policy.
- Only departments with the Open policy support link sharing; other department policies support invitation sharing only. Enterprise external-sharing restrictions still apply to Open departments.
- If an enterprise has a Confidential department, link shares cannot allow anonymous uploads, and open file collection boxes cannot be created.

## Set a File or Folder Classification {#file-setting}

1. Select the file or folder in the file list and open its details panel.
2. Locate **Security level** and select **Open**, **Internal**, **Restricted** or **Confidential**.
3. Complete the setting and check the displayed level. Changes must be made by someone with the appropriate classification-management permission.
4. Click **more** to review visibility, sharing requirements and operation restrictions.

![Security level dropdown with Open, Internal, Restricted and Confidential](../../assets/images/file-classification-level-picker-en-20261113.png)
*The file-details dropdown provides four security levels. Folders can also be assigned a classification.*

A department policy establishes department-wide requirements; file or folder classification manages a particular object. Check the object's displayed level and available operations. Changing one file's level does not change the entire department policy.

## Restrictions by File Level {#file-rules}

| File level in file details | Visibility and operations | Sharing requirements |
| --- | --- | --- |
| Open | Existing roles and file access controls apply | Invitation or link sharing is available where permissions and enterprise policies allow |
| Internal | Existing file permissions govern access and operations | Sharing outside the department requires supervisor authorization; invitation sharing only |
| Restricted | Ordinary members have read-only access and the operation restrictions below | Sharing requires supervisor authorization; invitation sharing only |
| Confidential (Top-secret in the policy table) | By default, visible only to the creator, project owner, file owner and department manager, not other department members | Sharing requires security officer authorization; invitation sharing only |

For **Confidential (Top-secret) and Restricted files**, ordinary members cannot:

- Move or copy the file.
- Upload a new version or download the file.
- Rename the file or view versions.

Supervisors and people with department file-management permission can perform these operations. Operation rights do not remove sharing-approval requirements. Visibility still depends on the person's role and file access permissions.

![File classification explanation opened from the more link](../../assets/images/file-classification-help-en-20261113.png)
*The explanation separates visibility, sharing authorization and ordinary-member restrictions. Scroll inside the dialog to read the remaining operation rules.*

## Examples {#examples}

| Scenario | Configuration | Expected behavior |
| --- | --- | --- |
| Routine internal department documents | Set the department to Ordinary | Existing and new files are Internal; sharing outside the department requires approval, and link sharing is unavailable |
| Finance contracts and settlement records | Set the department to Confidential | Existing and new files are Restricted; ordinary members have read-only access without download, and sharing requires approval |
| Sensitive documents handled by a small set of owners | Set the file level to Confidential | Default visibility is limited; sharing requires security officer authorization |
| Product materials intended for external distribution | Use Open policy and classification where external sharing is permitted | Authorized people enable sharing and configure permissions, password and expiry as needed; files do not become public automatically |

## FAQ {#faq}

### Does a department policy also change existing files? {#existing-files}

Yes. Existing department files automatically receive the corresponding classification, and subsequent uploads use it too. For example, the Confidential department policy maps to Restricted files; it is not limited to new uploads.

### Why does Confidential appear in both department policies and file levels? {#policy-names}

Read the label in context. The Confidential department policy assigns Restricted files. The Confidential option in file details is the highest file level, corresponding to Top-secret in the policy table. Ordinary department policy maps to Internal files. The mapping table above distinguishes these labels.

### Why can I view a file but not download or copy it? {#read-only}

Viewing and download or copy permissions are different. For Restricted and Confidential (Top-secret) files, ordinary members cannot move, copy, upload a new version, download, rename or view versions. A supervisor or someone with department file-management permission should handle these operations according to enterprise requirements.

### Can Internal, Restricted or Confidential files use link sharing? {#restricted-sharing}

No. These three file levels support invitation sharing only, subject to approval requirements. Departments with Ordinary, Confidential or Top-secret policies also do not support link sharing.

### Does setting a file to Open grant outsiders access? {#public-access}

No. Open is a classification, not an access grant. External recipients must use an allowed sharing method and remain subject to sharing permissions, passwords, expiry and enterprise external-sharing controls.

### Does classification replace file permissions or watermarks? {#other-controls}

No. Classification specifies security requirements; roles and file permissions determine access and operations; watermarks provide confidentiality notices and traceability markers. Use these controls together rather than relying on a label alone.

## Related Pages {#related}

- [Departments and Organization](department-management.md)
- [Permission System](permissions.md)
- [Sharing and Outbound Files](file-sharing.md)
- [Watermarks](watermark-security.md)
- [Security and Audit](security.md)
- [File Leakage Prevention](file-leak-prevention.md)