42 Color-coded data domains (labels + IRM)

A small badged label — three or four values, colour-coded, unambiguous — is published to Drive and made visible to the whole organization or to the users and groups that must see it. The label is then what a DLP rule keys on: 'Restricted' blocks external sharing, and IRM strips download, copy and print from viewers and commenters. The colour is documentation; the rule attached to it is the control.

Documentation: Get started as a classification labels admin ↗

Caveats

A label is a colour until a DLP rule enforces it¹
An unpublished label exists but does nothing²
Labels do not apply retroactively³
IRM restricts download, copy and print⁴

Setup steps

open ↗
https://admin.google.com/ac/dc/labels · captured 2026-07-15
Security › Access and data control › Label manager
Create the classification taxonomy as a badged label — few values, unambiguous, colour-coded. Three or four values, not ten.

Label
'Sensitivity' (badged)
values
Public / Internal / Confidential / Restricted

Create classification labels for your organization ↗
open ↗
https://admin.google.com/ac/managedsettings/55656082996 · captured 2026-07-15
Security › Access and data control › Label manager
Publish the label and set its visibility — the entire organization (the default) or only certain users and groups. An unpublished label exists but does nothing.

Status = Published; visible to entire organization

Create classification labels for your organization ↗
Security › Access and data control › Label manager
In the label's settings, tick the Applications checkboxes to make the label available in Drive; IRM is applied in the next step, as a DLP-rule action.

Label applications
Drive & Docs enabled
open ↗
https://admin.google.com/ac/dp · captured 2026-07-15
Security › Access and data control › Data protection
Attach a DLP rule to the label so that 'Restricted' actually blocks external sharing and applies IRM (the 'Disable download, print, and copy' rule action, where licensed) — the colour is documentation; the rule is the control.

Condition
Label 'Sensitivity' is 'Restricted'
Action
Block external sharing
Severity
High

Create DLP for Drive rules and custom content detectors ↗ Prevent users from downloading, printing, or copying files ↗

Ongoing maintenance

requires a human Quarterly: review the label taxonomy against how documents are actually classified.

How to verify

Open a labelled document as a test user and attempt the restricted action (download/print/copy) — IRM must refuse it.

v0.1.3Preventedition Business Std+ (enforce: Ent Std+, Frontline Std+, Edu, Ent Essentials Plus) policy #15 · #4 ↗