writing
Building LWMclassify: A Unified Data Classification and Tagging Platform
Data security begins with identifying stored information and ensuring it is handled appropriately. LWMclassify is a unified data classification and tagging platform designed as a modern, Linux-first alternative to legacy tools.
The primary objective of this project is to implement save-block enforcement. Users cannot save a document without assigning it a valid classification tag, such as Internal, Confidential, or Restricted.
Architecture and Technical Stack
The system utilizes a hybrid approach, separating the management console from the endpoint agent to maximize performance and security.
The Server
The management console handles reporting, audit trails, and policy configuration. The server is built with Elixir and Phoenix LiveView because the Erlang Virtual Machine (BEAM) provides excellent support for real-time WebSockets and concurrent connections from thousands of agents.
The server architecture includes:
- Zero-Inbound Design: The server never initiates a connection to the agents. It acts purely as a receiver, eliminating vectors for supply chain attacks.
- Append-Only Audit Logs: Cryptographic hashes are used to create a tamper-evident chain of findings.
- Real-Time Findings Dashboard: Administrators can review sensitive findings and immediately trigger actions, such as locking a file or escalating a classification level, without page reloads.
The Endpoint Agent
The endpoint agent is responsible for scanning, rule evaluation, and file tagging. The agent is built in Rust to ensure memory safety, minimal resource utilization, and cross-platform compilation for Windows, Linux, and macOS.
The agent features include:
- Context-Based Classification: A hybrid matching engine scans documents and utilizes OS-native OCR for images. If a document contains multiple sensitive data types, the agent automatically escalates the classification level to Restricted.
- Anti-Tamper Tagging: Instead of relying solely on Extended Attributes (xattr) or NTFS Alternate Data Streams, the agent embeds signed metadata directly into the file structure.
- Offline Resilience: The agent caches policies and queues findings locally in protected system paths. This ensures save-block enforcement cannot be bypassed by disconnecting from the network.
Development Roadmap
The project is structured into multiple phases. The current progress is as follows:
- Phase 1 and 2: The foundational schemas, REST APIs, and core Rust agent with the regex rule engine and tagging capabilities were completed.
- Phase 3: The Phoenix LiveView administrative dashboard for real-time monitoring and policy management was deployed.
- Phase 4: Development is currently focused on expanding the context-based tagging rules and administrator review workflows.
- Phase 5 and 6: Future updates will implement compliance reporting, enterprise hardening, and packaging for the official release.
Building LWMclassify demonstrates the capabilities of integrating systems programming in Rust with highly concurrent web backends in Elixir.