OR-003e — Information Handling Rule Enforcement

Go to OR-003 — Classified and Unclassified Environments

Statement

Crucible SHALL prevent an operation from handling information in a manner prohibited by the Information Handling Rules governing that information.

Derived From

This requirement derives from:

Crucible System Requirements Specification, Version 1.1 Draft, Operational Requirements, OR-003The Original Requirement states:

The system SHALL support classified and unclassified deployment environments.[C1]

OR-003e isolates the obligation to enforce the Information Handling Rules governing information processed by a Crucible operation.

Rationale

Authorization to process information within a Security Domain does not authorize every possible action involving that information.

Information Handling Rules can restrict how information is accessed, used, processed, stored, reproduced, transmitted, transferred, retained, archived, downgraded, declassified, sanitized, or destroyed.

OR-003e prevents a Crucible operation from performing an information-handling action prohibited by the rules governing the information.

Applies To

This requirement applies to:

Crucible operationsInformation processed by Crucible operationsInformation Handling RulesSecurity ClassificationsSecurity DomainsClassified EnvironmentsUnclassified Environments

Verification

Verification confirms that:

Each tested information object identifies or resolves to its governing Information Handling RulesCrucible permits a tested operation to perform an information-handling action authorized by the governing Information Handling RulesCrucible prevents a tested operation from performing an information-handling action prohibited by the governing Information Handling RulesCrucible prevents processing when the governing Information Handling Rules cannot be determinedCrucible records each denial caused by an Information Handling RuleEach denial record identifies the operation, information object, governing Information Handling Rule, requested action, and denial result

Referenced By

The following pages reference this requirement:

Delivery Phase

Implemented and Verified.

Implementation Status

Requirement Status

Issues

Notes for Editors

This requirement page should retain the stable requirement identifier OR-003e.

This page is a leaf requirement page and omits a trailing :start from its namespace.

OR-003e requires enforcement of established Information Handling Rules. It does not require Crucible to establish, approve, or modify those rules.

The responsible authority establishes:

The information governed by each ruleThe permitted information-handling actionsThe prohibited information-handling actionsThe conditions under which an action is permittedThe authority required to approve an exceptionChanges to the Statement should preserve:

as the responsible actorPrevention as the required behaviorA Crucible operation as the subject of enforcementInformation as the governed objectThe governing Information Handling Rules as the source of the prohibitionTo reference this requirement Statement from another wiki page, insert:

{{section>dido:02-crusible:99-annexes:annex-c-requirements:02-operational-requirements:or-003:or-003e#Statement&noheader&nofooter&noeditbtn}}

Do not rename this page after an external citation unless a redirect or move plan is in place.

© 2026 Dido Solutions, Inc. and Jackrabbit Consulting, Inc.