Classification That Acts on What Detection Finds

Detection and classification get talked about as one step. They are not. A scan can tell you that a column looks like a phone number and how confident it is in that call. It cannot tell you whether that phone number should be labeled Restricted in your organization, routed into a retention rule, or left alone because the file it lives in is a test fixture nobody ships. That second decision needs policy, and policy needs a place to live.

ClassifyIQ is that place. It takes what detection finds and applies rules your organization wrote to decide what each finding becomes.

Detection and classification are separate jobs

DiscoverIQ, backed by the shared AIQ engine, does the finding. A scan of a data source — a database, a file share, a SaaS connector — walks its schema and content and returns a result for each match: an attribute id (email address, government identifier, health record, and so on) paired with a confidence score. Detection combines pattern matching, dictionary lookups, and named-entity recognition to make that call, and each attribute type in the shared catalog also carries a baseline risk score.

ClassifyIQ takes over from there. It does not re-detect anything and it does not run a second model over the same data. It runs a rule engine over the results detection already produced, and that engine is deterministic: given the same scan results and the same rule set, it returns the same classification every time. Nothing about it is adaptive in the way a trained model is. It does not learn from corrections between runs, and it does not weight future decisions by how a rule performed in the past. Every scan is evaluated fresh against whatever rules exist at that moment. If an operator manually overrides a label because a rule got it wrong, that override changes the one record — it does not change how the rule engine reads the next scan.

That separation is deliberate. Detection is where confidence is meant to be probabilistic. Classification is where an organization needs a decision it can point to, defend to an auditor, and reproduce exactly.

What a rule can check

A classification rule is a set of conditions plus the level and label it assigns when they are all met. The conditions draw on what detection already produced and on properties of where the data lives:

A rule can combine several of these. "Government identifier, confidence above a threshold, found more than ten times in a shared drive file older than a year" is a single rule, not a special case bolted onto the engine.

Priority order and the default that catches everything

An organization can have many rules, and more than one can match the same attribute. ClassifyIQ resolves that by priority: rules are ordered, and the highest-priority rule that matches wins. Lower-priority rules that would also have matched are simply not applied — there is no blending or averaging of outcomes.

If nothing matches, the attribute is not left unclassified. Every organization sets a default classification level that acts as the floor: anything the rule set does not explicitly catch still gets labeled, at whatever level the organization has decided is the safe baseline. In practice this means the rule set can start narrow — a handful of high-priority rules for the data types that matter most — without leaving gaps for everything else.

Testing a rule before it runs everywhere

A rule that is wrong does not fail loudly. It mislabels every attribute it touches across future scans until the rule is corrected. Before a rule goes live, ClassifyIQ can run it as a dry run against existing scan results: the same conditions, evaluated against real detected attributes, without writing a classification. The operator sees what the rule would have matched and what level it would have assigned, and can adjust the conditions or the priority before turning it on.

An audit trail of which rule did what

Each time the rule engine runs, its decisions are recorded: which attribute was evaluated, which rule matched (or that the org default applied), and what classification level and label resulted. That record does not depend on remembering why a label was set — it is written at the moment the rule fires. When a classification is questioned later, the trail shows the exact rule and the exact conditions that produced it, not a reconstruction after the fact.

A classification is only as trustworthy as the rule that produced it, which is why ClassifyIQ writes down which rule fired every time one does. See it against your own scan results: book a ClassifyIQ demo and proof of concept.