Detects government security classification markings and banners across allied jurisdictions: Australia (PSPF), New Zealand (PSR), the United Kingdom (GSCP), the United States (EO 13526 classification banners and CUI banner markings), Canada (Directive on Security Management), the European Union (EUCI RESTREINT UE), and NATO. Intended for identifying classified or officially marked material moving outside approved government environments.
Detects the Australian Government OFFICIAL protective marking (PSPF / QGISCF) in both email forms ([SEC=OFFICIAL] subject markings, X-Protective-Marking headers) and visible document banners. Excludes UNOFFICIAL and OFFICIAL: Sensitive (handled by au-marking-sensitive). Regex logic ported from Microsoft's canonical PSPF SIT guidance; matched case-sensitively so the lowercase English word "official" does not trigger.
Detects the Australian Government PROTECTED protective marking (PSPF / QGISCF) in both email and document forms, sweeping up its IMM/caveat variants (Personal-Privacy, Legal-Privilege, Legislative-Secrecy, CABINET, NATIONAL-CABINET). SECRET and TOP SECRET roll up here so they receive at-least-PROTECTED handling. Regex logic ported from Microsoft's canonical PSPF SIT guidance; matched case-sensitively.
Detects the Australian Government SECRET and TOP SECRET security classifications in both email and document forms. Intended to surface content that should not be stored on the platform (these classifications roll up to the PROTECTED label in au-marking-protected for handling, while this SIT flags them for remediation). Matched case-sensitively.
Detects the Australian Government SENSITIVE tier in both email and document forms: Commonwealth OFFICIAL: Sensitive (including its IMM/caveat variants such as Personal-Privacy, Legal-Privilege, Legislative-Secrecy) and the Queensland (QGISCF) standalone SENSITIVE marking. Regex logic ported from Microsoft's canonical PSPF SIT guidance; matched case-sensitively.
Detects Government of Canada protective markings under the Treasury Board Standard on Security Categorization (Appendix J of the Directive on Security Management): the Canada-distinctive "Protected" designations Protected A / Protected B / Protected C (information whose compromise could injure interests outside the national interest), and the classified levels Confidential / Secret / Top Secret (injury to the national interest). "Protected A/B/C" is unique to Canada and matched at high confidence in both title-case and ALL-CAPS renderings; the classified words are shared vocabulary with other nations and are matched only at lower, Canada-government-context-gated tiers. Rendering verified directly against the Treasury Board Standard on Security Categorization; matched case-sensitively.
Detects European Union Classified Information (EUCI) protective markings as defined in Article 2(2) of Council Decision 2013/488/EU: the four bilingual French/English classification levels rendered together as a single marking — RESTREINT UE/EU RESTRICTED, CONFIDENTIEL UE/EU CONFIDENTIAL, SECRET UE/EU SECRET and TRÈS SECRET UE/EU TOP SECRET (the slash carries no surrounding spaces and TRÈS carries a grave accent, per the primary source). Named historically for RESTREINT but scopes the full EUCI ladder. The single-language French components (RESTREINT UE, CONFIDENTIEL UE, SECRET UE, TRÈS SECRET UE) are matched at a lower tier. Marking syntax verified directly against the Council Decision text; matched case-sensitively.
Detects NATO security classification markings under the NATO security policy (C-M(2002)49): the spelled-out national-security levels NATO RESTRICTED (NR), NATO CONFIDENTIAL (NC) and NATO SECRET (NS), and the highest level COSMIC TOP SECRET (CTS) — where the codeword COSMIC attaches only to TOP SECRET. ATOMAL caveat markings (NATO CONFIDENTIAL ATOMAL, NATO SECRET ATOMAL, COSMIC TOP SECRET ATOMAL) are covered as suffixes of their parent level marking. Marking syntax verified directly against the International Programs Security Handbook (US-government primary source reproducing NATO security-directive marking rules) and corroborating NATO security briefings; matched case-sensitively so ordinary lowercase prose ("a nato secret") does not trigger it.
Detects the New Zealand Government CONFIDENTIAL national-security classification under the Protective Security Requirements (PSR) classification system: the verified control/dissemination marking separator (CONFIDENTIAL//..., e.g. CONFIDENTIAL//NZEO) and a gated bracket form ([CONFIDENTIAL]). Deliberately narrow v1: no bare-word tier (CONFIDENTIAL is overwhelmingly common as generic business/legal boilerplate — NDAs, email footers, "STRICTLY CONFIDENTIAL", "PRIVATE AND CONFIDENTIAL" — and would swamp any bare-word detector), and the bracket tier is hard-gated by New Zealand government context because, unlike its sibling markings, [CONFIDENTIAL] is not a verified SEEMail trigger word. Regex logic verified directly against official PSR marking-format guidance (protectivesecurity.govt.nz); matched case-sensitively.
Detects the New Zealand Government IN-CONFIDENCE protective marking under the Protective Security Requirements (PSR) classification system: endorsed forms (e.g. MEDICAL IN-CONFIDENCE, BUDGET: IN-CONFIDENCE), the legacy SEEMail bracket trigger-word convention ([IN-CONFIDENCE]), and the bare ALL-CAPS document-banner form. Regex logic verified against the official PSR Classification Handbook (protectivesecurity.govt.nz) and Cabinet Office Circular CO(08)1; matched case-sensitively.
Detects the New Zealand Government RESTRICTED national-security classification under the Protective Security Requirements (PSR) classification system: the verified control/dissemination marking separator (RESTRICTED//..., e.g. RESTRICTED//REL TO NZL, GBR), the legacy SEEMail bracket trigger-word convention ([RESTRICTED]), and the bare ALL-CAPS document-banner form gated by New Zealand government context and a collocation-noise exclusion. Regex logic verified directly against official PSR marking-format guidance (protectivesecurity.govt.nz); matched case-sensitively.
Detects the New Zealand Government SECRET and TOP SECRET national-security classifications under the Protective Security Requirements (PSR) classification system: the verified control/dissemination marking separator ((TOP )SECRET//..., e.g. SECRET//NZEO, TOP SECRET//REL TO NZL, FVEY), the TOP SECRET banner-words phrase (tolerant of a hyphen or PDF-line-wrap-inserted whitespace between TOP and SECRET), and a New Zealand government/PSR-context-gated bare SECRET banner. Deliberately omits a SEEMail square-bracket trigger-word tier: the complete SEEMail bracket trigger-word set is [SEEMAIL]/[TRUSTED]/[RESTRICTED]/[SENSITIVE]/[IN-CONFIDENCE], all at or below SEEMail's own RESTRICTED-tier service ceiling, so [SECRET]/[TOP SECRET] bracket forms are structurally implausible and unattested. Regex logic verified directly against official PSR marking-format guidance (protectivesecurity.govt.nz); matched case-sensitively.
Detects the New Zealand Government SENSITIVE protective marking under the Protective Security Requirements (PSR) classification system: the legacy SEEMail bracket trigger-word convention ([SENSITIVE]), endorsed forms (e.g. BUDGET SENSITIVE, COMMERCIAL: SENSITIVE, CABINET SENSITIVE), and the bare ALL-CAPS document-banner form gated by New Zealand government context. Regex logic verified against the official PSR Classification Handbook (protectivesecurity.govt.nz) and Cabinet Office Circular CO(08)1; matched case-sensitively.
Detects the UK Government Security Classifications Policy (GSCP) OFFICIAL classification and its -SENSITIVE marking, written OFFICIAL-SENSITIVE and applied immediately after the OFFICIAL classification per the current policy. Matches the verified structured "CLASSIFICATION - HANDLING INSTRUCTION[- DESCRIPTOR]" format (e.g. OFFICIAL-SENSITIVE - RECIPIENTS ONLY, OFFICIAL-SENSITIVE - COMMERCIAL) using the centrally-defined GSCP handling-instruction and descriptor vocabulary, the bare OFFICIAL-SENSITIVE banner, and — at a lower, UK-government-context gated tier — bare OFFICIAL alone, which is a common English word. Regex logic verified directly against the current Government Security Classifications Policy (gov.uk, version 2.0, August 2024); matched case-sensitively so ordinary lowercase English use of "official"/"official-sensitive" does not trigger it.
Detects the UK Government Security Classifications Policy (GSCP) SECRET and TOP SECRET national-security classifications: the verified UK Prefix form (UK SECRET / UK TOP SECRET, applied to assets shared with foreign governments or international organisations), the classification followed by a verified National Caveat handling instruction (SECRET/TOP SECRET - UK EYES ONLY, - UK/US EYES ONLY, - FIVE EYES ONLY, per the GSCP's "CLASSIFICATION - HANDLING INSTRUCTION" additional-marking format — National Caveats apply only to SECRET and TOP SECRET, never OFFICIAL), the distinctive TOP SECRET banner-words phrase, and a UK-government-context-gated bare SECRET banner. Intended to surface content that should not reside on this platform. Regex logic verified directly against the current Government Security Classifications Policy (gov.uk, version 2.0, August 2024); matched case-sensitively.
Detects U.S. national-security classification banner and portion markings (per Executive Order 13526 and the Intelligence Community marking system): a classification level — TOP SECRET, SECRET, CONFIDENTIAL — followed by one or more "//"-separated control or dissemination markings (SI, TK, HCS, SCI, SAP, NOFORN, ORCON, REL TO ...), or a parenthetical portion mark such as (S//NF) or (TS//SI). The bare words "secret" and "confidential" are far too common to match alone, so a match requires the "//" control structure or a parenthetical portion mark.
Detects Controlled Unclassified Information (CUI) banner and portion markings as defined by 32 CFR 2002.20 and the NARA CUI Registry. A CUI banner is the control marking "CUI" optionally followed by category markings (CUI//SP-PRVCY) and limited-dissemination controls (//NOFORN, //FEDCON, //FED ONLY, //NOCON, //DL ONLY, //REL TO ...), with elements separated by double slashes. The bare token "CUI" is too common to match alone, so a match requires either the "//" banner structure or the spelled-out phrase "Controlled Unclassified Information".