Auto-labeling and Default Labels

Because no DLP condition matches an unlabeled file, the label gate covers only what is labeled. This chapter is the inversion: default labels, mandatory labeling, and service-side auto-labeling on the content types that matter.

In GCC High

Every row below is a documented claim until a tenant check turns it into an observation. The basis column says which, and when.

Status rows for this chapter are added to src/data/copilot/controls.ts as the chapter is written; the table renders here.