New Zealand Marking - RESTRICTED

Detects the New Zealand Government RESTRICTED national-security classification under the Protective Security Requirements (PSR) classification system: the verified control/dissemination marking separator (RESTRICTED//..., e.g. RESTRICTED//REL TO NZL, GBR), the legacy SEEMail bracket trigger-word convention ([RESTRICTED]), and the bare ALL-CAPS document-banner form gated by New Zealand government context and a collocation-noise exclusion. Regex logic verified directly against official PSR marking-format guidance (protectivesecurity.govt.nz); matched case-sensitively.

Type

regex

Engine

boost_regex

Confidence

high

Confidence justification

High confidence on the `//` national-security-marking form and the legacy-bracket form: both are structurally distinctive, case-sensitive tokens with low natural-English collision risk, and the `//` separator convention is directly verified against the official PSR marking-format guidance (not inferred). The bare RESTRICTED banner (65) is a common English word used constantly outside government context (RESTRICTED AREA, AGE RESTRICTED, RESTRICTED ACCESS, etc.), so it is the widest tier and is gated by New Zealand government/PSR corroborative evidence plus a dedicated NOT-exclusion for the most common non-government collocations.

Jurisdictions

nz

Regulations

Privacy Act 2020 (NZ)

Frameworks

PSR

Data categories

government, security

Scope

narrow

Risk rating

8

Platform compatibility

Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Compatible, Netskope: Compatible

Pattern

\bRESTRICTED//[A-Z]|\[RESTRICTED\]

Corroborative evidence keywords

New Zealand, PSR, Protective Security Requirements, Cabinet

Proximity: 300 characters

Should match

• Cover sheet: RESTRICTED//REL TO NZL, GBR — do not release outside Five Eyes partners. — Verified national-security marking format — RESTRICTED classification with a REL TO releasability marking, double-forward-slash separated per PSR marking-format guidance
• Briefing note marked RESTRICTED//REL TO NZL, AUS, GBR for distribution to accredited staff only. — PDF-wrapped dissemination list — the line wrap falls after the RESTRICTED// trigger, which remains an unbroken token per PSR guidance (the classification and control/dissemination markings render in the same style/font, immediately adjoining)
• Subject: [RESTRICTED] Draft briefing paper for review — Legacy SEEMail bracket trigger-word form
• This RESTRICTED briefing must be handled under New Zealand Government PSR requirements. — Bare banner form gated by New Zealand government/PSR corroborative evidence within 300 characters

Should not match

• please restrict access to senior staff until further notice — lowercase English word (case-sensitive exclusion)
• RESTRICTED AREA — HARD HAT ZONE, authorised personnel only beyond this point — bare tier excluded by the RESTRICTED-collocation NOT-group
• This film is AGE RESTRICTED and unsuitable for viewers under 18. — bare tier excluded by the RESTRICTED-collocation NOT-group
• RESTRICTED (sample) — replace with your organisation's classified content — bare tier excluded by the template/noise NOT-group (documentation/sample content)

Known false positives

• ALL-CAPS prose (legal boilerplate, headers, or documents rendered entirely in capitals) defeats the case-sensitivity signal the bare RESTRICTED banner tier relies on. Mitigation: Treat banner-tier-only (65) hits as lower confidence when the surrounding text is itself all-caps; the `//` tier (85) and legacy-bracket tier (75) remain the reliable signal.
• RESTRICTED is an extremely common English word in everyday non-government usage (RESTRICTED AREA, RESTRICTED ACCESS, ACCESS RESTRICTED, AGE RESTRICTED, RESTRICTED STOCK, RESTRICTED USE, USE RESTRICTED), all of which are more common in general text than the PSR classification marking. Mitigation: The bare tier (65) requires New Zealand government/PSR corroborative evidence and excludes this collocation set via a dedicated NOT-group. The `//` (85) and bracket (75) tiers are unaffected — they are structurally distinctive and do not require the gate.
• The SEEMail square-bracket trigger-word convention ([RESTRICTED]) is being decommissioned during 2026 as the Secure Government Email (SGE) Framework replaces SEEMail. RESTRICTED is confirmed as one of SEEMail's five bracket trigger words (the complete list is [SEEMAIL], [TRUSTED], [RESTRICTED], [SENSITIVE], [IN-CONFIDENCE] — verified directly against the PSR marking-guidance page), so this tier reflects a real, current, if soon-to-be-legacy convention. Mitigation: Weight the bracket tier (75) as a transitional/legacy indicator; the `//` and gated bare-banner tiers reflect the durable PSR marking convention and are expected to remain valid after SEEMail's decommissioning.
• The `\bRESTRICTED//` trigger requires the double-forward-slash to immediately follow the classification word with no space. No verified source shows a spaced variant (e.g. "RESTRICTED //"); if one exists in the wild it would not be matched by this tier. The regex additionally requires an uppercase letter immediately after the separator (//[A-Z]) so that accidental double-slashes in URLs or file paths (e.g. /RESTRICTED//shared/) cannot fire it. Mitigation: No mitigation implemented; documented as a known coverage gap rather than broadening the regex on unverified syntax.

Collections

• NZ Protective Markings