> ## Documentation Index
> Fetch the complete documentation index at: https://docs.kvelden.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Data Sharing Policies

> Three-tier policy cascade that controls who can share files, to whom, and under what conditions.

## Overview

Data sharing policies let security officers enforce organisation-wide rules about how encrypted files leave a room. Policies are set from **Security → Policies → Data Sharing**.

<Note>
  The **Security → Policies** hub contains multiple policy types beyond data sharing: Storage, Encryption, DLP, Org Unit Roster, Clearance Matrix, Access Reviews, and Alert Policies. This page covers the Data Sharing tab only. See [Security Alerts](/enclave/security-alerts) for alert policy configuration and [DLP](/enclave/dlp) for content-scanning policies.
</Note>

Enclave enforces a **most-restrictive-wins** model across three policy tiers. Each tier can only tighten restrictions — it can never loosen a block applied by an outer tier.

```
Tenant policy (master switch)
  └── Classification policy (per C1–C4 level)
        └── Per-type rules (per Org Unit type label)
```

## Share targets

When a user shares a file or folder, they choose a **direction** and a **target type**:

| Direction | Target   | Description                                           |
| --------- | -------- | ----------------------------------------------------- |
| Internal  | Tenant   | All members of the same organisation                  |
| Internal  | Org Unit | All members of a specific Org Unit (and its children) |
| Internal  | User     | A specific user within the organisation               |
| External  | Tenant   | All members of a different organisation               |
| External  | User     | A specific user in a different organisation           |

<Note>
  Org Unit sharing is always internal. There is no concept of sharing to an external org unit.
</Note>

## Tier 1 — Tenant policy

The tenant policy is the master on/off switch for all sharing directions. Navigate to **Security → Policies → Data Sharing** and toggle:

* **Allow internal sharing** — enables sharing to internal targets (Tenant, Org Unit, User)
* **Allow external sharing** — enables sharing to external targets

If internal sharing is off, no internal sharing is possible regardless of classification policy.

## Tier 2 — Classification policy

For each classification level (C1–C4), you can configure per-target-type controls. These apply on top of the tenant policy — they can only restrict further.

| Setting                   | Effect                                                |
| ------------------------- | ----------------------------------------------------- |
| **Block Tenant**          | Prevents sharing to the entire internal tenant        |
| **Block Org Unit**        | Prevents sharing to any Org Unit                      |
| **Block User**            | Prevents sharing to individual users                  |
| **Block External Tenant** | Prevents sharing to external tenants                  |
| **Block External User**   | Prevents sharing to external users                    |
| **Require expiry**        | Every share at this level must include an expiry date |
| **Require PIN**           | Every share at this level must be protected by a PIN  |
| **Block folder share**    | Prevents sharing entire folders at this level         |

Classification levels cascade independently — you can allow C1 files to be shared freely while blocking C3 files from being shared to external users.

## Tier 3 — Per-type rules

When **Block Org Unit** is off at tier 2 (org unit sharing is allowed), you can add additional restrictions scoped to specific **Org Unit type labels** (e.g. Domain, Team, Division).

Per-type rules can only add restrictions — they cannot loosen a block from tier 1 or tier 2.

| Rule               | Effect                                                                       |
| ------------------ | ---------------------------------------------------------------------------- |
| **Block**          | Sharing to any Org Unit of this type is blocked at this classification level |
| **Require expiry** | Shares to this type must include an expiry date                              |
| **Require PIN**    | Shares to this type must be PIN-protected                                    |

### Example

Policy for **C3 (Confidential)**:

* Block Org Unit: **off** (org unit sharing allowed)
* Per-type rule for "Domain": **Block = on**
* Per-type rule for "Team": **Require expiry = on**, **Require PIN = on**

Result: C3 files cannot be shared to Domain units at all. Sharing to Team units is allowed but requires both an expiry date and a PIN.

### How type labels work

Type labels on Org Units are free-text (e.g. Domain, Department, Team, Squad). Per-type rules match on the label case-insensitively. You configure rules by typing or selecting the label in the policy editor.

<Warning>
  Per-type rules only apply when the base **Block Org Unit** setting is off. If org unit sharing is blocked at tier 2, per-type rules are ignored — the block always wins.
</Warning>

## Clearance-based share controls

On top of the three policy tiers, sharing is gated by **clearance** (see
[Clearance Levels](/organization/clearance)) — a mandatory access control that
policy tiers cannot override:

* **Sharer must be cleared.** You cannot share a file whose classification exceeds
  your own clearance — you cannot share what you cannot read.
* **Internal recipient must be cleared.** When sharing to a *single* internal
  user, that user's clearance must meet the file's classification, or the share
  is refused with a clear reason. Group targets (Org Unit / Tenant) can't be
  checked per-member at share time, so clearance is enforced for each member at
  **read time** instead.

### External links to confidential data (approval workflow)

Creating an **external (federated) invitation** carries a **clearance ceiling** —
the highest classification the guest may open. Granting a **C3 (Confidential)** or
**C4 (Restricted)** ceiling is a high-sensitivity action and is **held for
administrator approval**:

1. The inviter chooses a clearance ceiling of C3 or C4 and supplies a **mandatory
   justification**.
2. Instead of issuing the link immediately, Enclave opens an **N-of-M approval
   workflow** whose approvers are the room's administrators. The inviter sees a
   "pending approval" state.
3. Approvers review and decide from the normal **Approvals** queue. Once the
   threshold of approvals is met, the invitation is minted and emailed to the
   recipient automatically. If rejected or expired, no link is ever created.

Invitations with a **C1/C2** ceiling are issued immediately, as before.

The ceiling is also bounded from below by the **room's classification floor**: a
room classified **Internal**, **Confidential**, or **Restricted** requires a
ceiling of at least **C2**, **C3**, or **C4** respectively. Enclave pre-selects
the floor in the invitation form and rejects anything lower — a guest who cannot
open the room's own files has no reason to be in the room.

<Note>
  The clearance ceiling also filters what the guest sees: files above the ceiling
  never appear in the external file list, and any download attempt above it is
  refused. External parties start at **C1** (public only) unless granted more.
</Note>

## Security model

* **Cascade direction**: Tenant → Classification → Per-type. Each level can only tighten.
* **Clearance is mandatory**: the clearance checks above apply on top of policy and cannot be loosened by any tier.
* **Most restrictive wins across files**: When sharing multiple files in one operation, the most restrictive policy among all the files applies to the entire batch.
* **PIN hashing**: PINs are hashed with bcrypt at rest. Kvelden never stores or sees the raw PIN.
* **Expiry enforcement**: Expired shares are automatically rejected at access time — the recipient cannot access the file after the expiry timestamp.
* **Audit trail**: Every share creation and access attempt is written to the immutable audit log.

## Configuring policies

1. Navigate to **Security → Policies → Data Sharing**
2. Use the matrix to see all four classification levels side-by-side
3. Click a level to expand the editor
4. Toggle blocking rules and security requirements
5. To add per-type rules: with **Block Org Unit** off, scroll to the **Org Unit type rules** section, select or type a type label, and configure its restrictions
6. Click **Save policy**

Changes take effect immediately for new share operations. Existing shares are not revoked.