Data classification label management and access control

A method performed by a computer, the method comprising:

• receiving, from a client application executing on a client device, a first request to fetch data classification labels from a policy server;
• retrieving authentication information for the client application and passing the authentication information to the policy server;
• receiving, based on a rights check performed using the authentication information, an access token from the policy server, the access token controlling which data classification labels of a plurality of data classification labels stored at the policy server are allowed to be retrieved for the client application or a user of the client application;
• providing the access token to an interface for the policy server for use in generating a second request for a list of data classification labels accessible via the access token, wherein the list of data classification labels comprises a subset of the plurality of data classification labels stored at the policy server selected based on the access token;
• receiving the list of data classification labels based on the generation of the second request;
• and
• generating, for output to the client application, output data corresponding to the list of data classification labels, wherein generating the output data includes deserializing the list of data classification labels and translating the list of data classification labels to a format compatible with the client application, and wherein the output data is usable by the client application to generate a presentation of the list of data classification labels for selection by the user of the client application to classify data managed by the client application.

A system, comprising:

• one or more hardware processors with memory coupled thereto;
• computer-readable media storing instructions executable by the one or more hardware processors, the instructions comprising:
• first instructions to interface with a policy server and dynamically retrieve data classification labels from the policy server on request based on performance of at least a first rights check, and propagate the data classification labels to an application executing on a web client, the first rights check being performed to secure the data classification labels and comprising receiving, upon passing the first rights check, an access token controlling access to the data classification labels based on a first transmission of authentication information from the application and creating a policy server engine at a policy server software development kit (SDK) using the access token and interfacing with the policy server using the policy server engine to retrieve and return the data classification labels in accordance with rights provisioned to the application or a user of the application;
• second instructions to receive an indication from the application that a first data classification label of the data classification labels is to be applied to a data file;
• third instructions to perform a second rights check based on a second transmission of authentication information from the application;
• and
• fourth instructions to apply the first data classification label to the data file and process the data file in accordance with the applied first data classification label responsive to passing the second rights check.