Classifier for Confluence
How permissions work
Confluence already controls who can see and edit your pages. Classifier builds on top of that: it turns a page's classification into access rules so the right people see the right content automatically. This page explains how those pieces fit together — no technical background needed.
1 The Confluence foundation
Before Classifier does anything, every page is already governed by two built-in Confluence layers. The page-level layer only applies when a page has its own restrictions.
SPACE Space permissions
- Default access for every page in the space
- Separate View and Edit grants for groups and people
- Space admins manage the space and can always get in
- Used when a page has no restrictions of its own
PAGE Page restrictions
- Per-page View / Edit rules
- When set, the page uses these instead of the space defaults
- This is exactly where Classifier applies a page's classification
- No page restrictions set? Confluence falls back to the space rules
2 What Classifier adds
You classify parts of the page, or the whole page. Classifier rolls those markings up to the most restrictive classification, finds the Confluence group for that level, and sets the page's restrictions to that group. Confluence still does the enforcing — Classifier simply puts the correct access rules in place for you.
How the group is chosen
- Each classification level maps to a specific group name
- An optional per-space prefix can be added to the name
- The group name must match exactly — there is no guessing
- If the matching group doesn't exist yet, the save is stopped with a clear message so nothing is half-applied
ON SAVE What gets set
- The page's View/Edit rules are replaced to match the classification
- The classification group is granted View + Edit
- Confluence admins and space admins keep their access
- Existing space members are kept or set aside depending on the mode (next section)
- Access is managed by group, not by adding people one at a time
3 Two restriction modes
A site-wide setting decides how strict page access is. The default is Selective restriction.
🔒 Most restrictive
- Page access is limited to the classification group plus admins
- Existing space members are not automatically carried over
- To open the page, you must be in the classification group
- If you can open the page, you can see all of its markings
🎚️ Selective restriction
- The classification group gets View + Edit, and existing space members are kept too
- Anyone with space or page View can open the page
- Members of the classification group get full access (view, edit, all markings)
- Everyone else gets view-only; any marking they aren't cleared for simply doesn't appear
Scenario: mixed page in selective mode
Page banner: Secret//SAP//REL TO USA. Body has one Secret/SAP paragraph and one Unclassified paragraph.
Sees the full page including the classified paragraph. Can edit if page Edit is granted.
Opens the page. Sees banner and Unclassified paragraph. Secret/SAP block does not appear.
Scenario: Secret page in most restrictive mode
Page banner: Secret//NONE//REL TO USA
Can view and edit (if Edit granted). Sees all content.
Cannot open the page — even with space View.
◇ The classification model
Each marking combines up to three parts, shown in order:
Level // Compartment // Release-to
| Part | Examples | Meaning |
|---|---|---|
| Level | Top Secret, Secret, Confidential, Unclassified | Overall sensitivity — stricter levels win on rollup |
| Compartment | SCI, SAP, SI | Specialized access beyond level alone |
| Release-to | REL TO USA, REL TO USA, CAN | Which partners may receive the information |
Markings appear inline on content, on the page banner (rollup), or as typed markers converted to macros on save. Unclassified is valid — it stays visible to anyone who can view the page.
Example — banner to group
Banner: Top Secret//SAP//REL TO USA · Prefix: cls- → Group: cls-top secret-sap-rel to usa (exact match required)
4 Classification-restricted spaces
A space can be flagged as classification restricted. When it is, the rules tighten and the space always uses Most restrictive mode.
SPACE What changes
- Selective viewing is turned off — it's always most restrictive
- Only the classification levels on the space's allowed list can be used
- A default classification is applied to pages that don't have one
- The first time a page is opened, its default and access are filled in automatically
ACCESS The "both must be true" rule
- Anyone who isn't an admin must meet both conditions:
- ① be a member of the space (View/Edit), and
- ② be in the page's classification group
- Missing either one means no access
5 What happens when someone opens a page
Here's the order of checks Classifier and Confluence run to decide what a person sees.
6 Quick reference
| Scenario | Mode | Who can View / Edit | Marking visibility |
|---|---|---|---|
| Normal space, selective, classified | Selective | Classification group: View + Edit · others: space/page View | Based on each person's group membership |
| Normal space, most restrictive | Most restrictive | Classification group + admins only | Same as page access |
| Classification-restricted space | Always most restrictive | Space members AND classification group | No selective view mode |
| Unclassified page | Depends on setup | Space rules / UNCLASSIFIED rules | UNCLASSIFIED always visible |
| Matching group doesn't exist yet | — | Save is blocked with a clear message | — |
7 What happens when you save
Order matters: access is set before the new classification is stored, so a page never shows a new classification without the matching access already in place.
- 1Check the request — confirm the classification is valid and allowed
- 2Apply space rules — in a restricted space, fall back to the allowed or default level if needed
- 3Set access — update the page so the classification group (plus admins, and space members if selective) has the right View/Edit
- 4Store the classification — save the banner and level on the page
- 5Record it — keep a quick-read copy and an audit trail of the change
8 Who can do what
| Role | Configuration | Classify | View classified pages |
|---|---|---|---|
| Confluence admin | Global scheme, rollup, restriction mode | Yes | Always |
| Space admin | Space settings, defaults, allowed list | Yes | Always in their space |
| Author / editor | — | Yes | Per group membership & mode |
| Viewer | — | — | Per groups; selective may hide passages |
Rules of thumb
- Banner, stored classification, and permissions must agree. Re-save through Classifier after reclassification so access updates.
- Groups are the access key. Clearance is Confluence group membership managed outside the plugin.
- Selective = open page, filtered passages. Most restrictive = closed page unless in the banner group.
- Restricted space = AND rule. Space access plus classification group — both required.
- UNCLASSIFIED stays visible to anyone who can view the page in selective mode.
9 Common questions & fixes
| What you see | Likely cause | What to do |
|---|---|---|
| Banner shows a new level, but people still need the old group | The banner changed without re-applying access | Open and save the page so the access rules are re-applied |
| Someone in the right group can't open the page | The page's access still points at the old group | Re-apply the classification so access matches the banner |
| A normal space suddenly acts locked-down | The space's "classification restricted" setting is on | Check Space Tools and turn classification restricted off |
| Save is blocked | The matching group doesn't exist in Confluence yet | Create the group for that classification level, then save |
| Selective mode, but a user sees every marking | They're in the classification group or are an admin | Expected — those users have full access |
| A view-only user can still edit | They were granted Edit at the page or space level | Confluence's Edit permission wins — adjust that grant |
Want to see it on your own pages?
Classifier for Confluence lets you classify pages, roll up portion markings, and control access automatically — using the Confluence permissions you already trust.