The self-classification problem
A structurally unenforceable policy, systematic underclassification at thousands of documents a day, and why keyword matching was never going to close the gap.
Every company with an internal wiki has some version of this policy: label your documents public, internal use only, confidential, or highly confidential, based on what's in them. At a large financial institution, that policy was written by legal, was detailed and precise — and was almost entirely dependent on individual employees reading it, understanding it, and applying it correctly to their own documents, every time, on a platform receiving thousands of new documents a day.
That's the setup this project inherited. Not a missing tool — a structurally unenforceable policy.
This is Part 1 of four. Part 2 covers the two-agent architecture; Part 3 covers the engineering problems that mattered more than model accuracy; Part 4 covers rollout and results.
The gap wasn't malice. It was friction.
Nobody was trying to leak sensitive information. The failure mode was almost always the same: someone uploads a document, doesn't think hard about which of four labels applies, picks something reasonable-sounding, and moves on.
Multiply that by thousands of documents a day, across an organization where the policy itself evolves over time, and you get a predictable outcome — systematic underclassification. Documents that should have been marked confidential or highly confidential were sitting labeled as public or internal use only, because reading and correctly applying an evolving legal policy document isn't most people's job, and doing it perfectly, every time, isn't realistic at any scale.
| Label | Intended audience | What went wrong in practice |
|---|---|---|
| Public | Anyone in the company | Sensitive client or deal detail filed here by default |
| Internal use only | Employees, low sensitivity | Confidential financial data treated as "just internal" |
| Confidential | Need-to-know roles | Underused — the middle label felt "safe enough" |
| Highly confidential | Restricted access | Almost never self-selected without external pressure |
The risk this created was concrete: a highly confidential document mislabeled as public isn't a paperwork problem — it's readable by anyone in the company from the moment it's saved.
And the scale made manual policing impossible. No security or compliance team was going to read thousands of documents a day and cross-reference each one against the latest version of a legal policy. The gap wasn't a lack of rules. It was the absence of anything standing between the rules and the people expected to follow them.
Why this became a machine learning problem
The instinct might be to build a rules-based checker — keyword matching, regex for known-sensitive patterns. That breaks fast against real documents:
What the problem actually needed was something that could read a document the way a careful, policy-literate employee would, at a speed and scale no team of humans could sustain — and, critically, something that could point to why it reached a conclusion, since a black-box label change would never be trusted by users or by legal.
That last point ended up shaping almost every architectural decision that followed.
| Approach | Strength | Failure mode at scale |
|---|---|---|
| Manual review | High trust, full context | Thousands of docs/day — impossible staffing |
| Keyword / regex | Fast, cheap | Misses context-dependent sensitivity |
| Single-pass LLM | Reads full document | Wrong on the cases that matter most (Part 2) |
| Two-agent + justification | Policy-aware, auditable | Harder to build — but defensible |
What comes next
| Part | Focus |
|---|---|
| 1 (this post) | The self-classification problem — why policy alone doesn't scale |
| 2 | Two-agent design, distillation, RLHF, and Confluence integration |
| 3 | Grounding citations in real document text; the disclosure paradox |
| 4 | Phased rollout, the 85% underclassification reduction, lessons for today |
What I learned
The most important framing shift was treating underclassification as a systems problem, not a compliance training problem. You can't policy your way out of a workflow where the default action is "pick a label and move on." Something has to sit in the save path — fast enough to feel native, transparent enough to earn trust, and conservative enough that a missed sensitive document is the rare failure, not the common one.