Classifier for Confluence / Access Control Overview
Classifier for Confluence
Access Control Overview
Restricting view and update by classification
Classifier for Confluence is built to enforce who can view and who can update Confluence content according to data classification rules — not only labels on a page, but Confluence permissions driven by those classifications.
The problem
Standard Confluence space permissions and page restrictions do not natively understand formal classification combinations (level, compartments, and release-to). Organizations that mark content with classifications still need a reliable way to ensure:
- Only cleared users can view content at or above a given classification.
- Only users in the matching classification group can update or publish classified pages.
- Space membership alone is not enough if the user lacks the required classification group.
How Classifier solves it
Classifications map to Confluence groups
Users are placed in those groups by your organization after clearance — not by the app inventing clearances.
Rollup at save/publish
When pages are classified and saved or published, Classifier rolls unique in-page classifications up to the most restrictive page-level (banner) classification.
View and update follow the groups
Permissions are applied using those classification groups so access tracks the rollup classification.
Restricted spaces go further
Space members (groups or individuals) must also belong to the classification groups set for that space — space assignment plus classification group.
No group, no access
Users who lack the matching classification group cannot view corresponding content; update/publish is blocked when user groups do not authorize the classification rollup.
Tree inheritance stays safe
Child pages inherit parent restrictions through Confluence’s cumulative page-tree model, so access cannot be widened downward unintentionally.
REST API is covered too
Classification controls do not stop at the UI. Classifier monitors Confluence REST API traffic and applies the same access rules to every REST API attempt — so programmatic access cannot bypass the classification permissions enforced in the browser.
What this means in practice
Classifier turns classification from a visual label into enforceable Confluence security: view and update follow the same classification groups your security model already uses. Confluence admins control whether a space uses space-level classification; when enabled, restrictions apply consistently across that space.
Summary
Classifier for Confluence solves restricting view and update based on classification by binding classifications to Confluence groups and applying those groups to page (and space) permissions at save/publish and access time.