====== OR-003e — Information Handling Rule Enforcement ======

[[dido:02-crusible:99-annexes:annex-c-requirements:02-operational-requirements:or-003:start|Go to OR-003 — Classified and Unclassified Environments]]

===== Statement =====

[[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]] SHALL prevent an operation from handling information in a manner prohibited by the [[dido:99_annexes:annex-b-terms-and-definitions:i:information_handling_rules|Information Handling Rules]] governing that information.

===== Derived From =====

This requirement derives from:

  * [[dido:02-crusible:99-annexes:annex-c-requirements:02-operational-requirements:or-003:start|OR-003 — Classified and Unclassified Environments]]
  * Crucible System Requirements Specification, Version 1.1 Draft, Operational Requirements, OR-003

The Original Requirement states:

> //The system SHALL support classified and unclassified deployment environments.//[[dido:02-crusible:99-annexes:annex-b:cr-001|[C1]]]

OR-003e isolates the obligation to enforce the Information Handling Rules governing information processed by a Crucible operation.

===== Rationale =====

Authorization to process information within a [[dido:99_annexes:annex-b-terms-and-definitions:s:security_domain|Security Domain]] does not authorize every possible action involving that information.

[[dido:99_annexes:annex-b-terms-and-definitions:i:information_handling_rules|Information Handling Rules]] can restrict how information is accessed, used, processed, stored, reproduced, transmitted, transferred, retained, archived, downgraded, declassified, sanitized, or destroyed.

OR-003e prevents a Crucible operation from performing an information-handling action prohibited by the rules governing the information.

===== Applies To =====

This requirement applies to:

  * [[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]]
  * Crucible operations
  * Information processed by Crucible operations
  * [[dido:99_annexes:annex-b-terms-and-definitions:i:information_handling_rules|Information Handling Rules]]
  * [[dido:99_annexes:annex-b-terms-and-definitions:s:security_classification|Security Classifications]]
  * [[dido:99_annexes:annex-b-terms-and-definitions:s:security_domain|Security Domains]]
  * [[dido:99_annexes:annex-b-terms-and-definitions:c:classified_environment|Classified Environments]]
  * [[dido:99_annexes:annex-b-terms-and-definitions:u:unclassified_environment|Unclassified Environments]]

===== Verification =====

Verification confirms that:

  - Each tested information object identifies or resolves to its governing [[dido:99_annexes:annex-b-terms-and-definitions:i:information_handling_rules|Information Handling Rules]]
  - [[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]] permits a tested operation to perform an information-handling action authorized by the governing Information Handling Rules
  - Crucible prevents a tested operation from performing an information-handling action prohibited by the governing Information Handling Rules
  - Crucible prevents processing when the governing Information Handling Rules cannot be determined
  - Crucible records each denial caused by an Information Handling Rule
  - Each denial record identifies the operation, information object, governing Information Handling Rule, requested action, and denial result

===== Referenced By =====

The following pages reference this requirement:

{{backlinks>.#dido:02-crusible}}

===== Delivery Phase =====

Implemented and Verified.

===== Implementation Status =====

<todo>Assess whether the current Crucible implementation prevents operations from handling information in a manner prohibited by the governing Information Handling Rules.</todo>

===== Requirement Status =====

<todo>Review and approve OR-003e as a leaf requirement derived from OR-003.</todo>

----
===== Issues =====

<todo>Define how Crucible associates Information Handling Rules with each information object.</todo>

<todo>Define how Crucible resolves Information Handling Rules inherited from a Security Classification, Security Domain, source, owner, or governing authority.</todo>

<todo>Define how Crucible resolves conflicting Information Handling Rules.</todo>

<todo>Define the behavior required when an information object does not identify or resolve to governing Information Handling Rules.</todo>

<todo>Define the information-handling actions that Crucible can authorize or prohibit.</todo>

<todo>Define the record required when Crucible prevents an operation because of an Information Handling Rule.</todo>

----
===== Notes for Editors =====

This requirement page should retain the stable requirement identifier ''OR-003e''.

This page is a leaf requirement page and omits a trailing '':start'' from its namespace.

OR-003e requires enforcement of established Information Handling Rules. It does not require Crucible to establish, approve, or modify those rules.

The responsible authority establishes:

  * The information governed by each rule
  * The permitted information-handling actions
  * The prohibited information-handling actions
  * The conditions under which an action is permitted
  * The authority required to approve an exception

Changes to the Statement should preserve:

  * [[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]] as the responsible actor
  * Prevention as the required behavior
  * A Crucible operation as the subject of enforcement
  * Information as the governed object
  * The governing [[dido:99_annexes:annex-b-terms-and-definitions:i:information_handling_rules|Information Handling Rules]] as the source of the prohibition

To reference this requirement Statement from another wiki page, insert:

<code dokuwiki>
{{section>dido:02-crusible:99-annexes:annex-c-requirements:02-operational-requirements:or-003:or-003e#Statement&noheader&nofooter&noeditbtn}}
</code>

Do not rename this page after an external citation unless a redirect or move plan is in place.

----

<WRAP centeralign>
© 2026 Dido Solutions, Inc. and Jackrabbit Consulting, Inc.
</WRAP>