Held once, labeled once.
A control layer holds two things you would rather it did not leak: the credentials it uses to reach your systems, and the sensitive values passing through it on the way to a decision.
A service you deploy.
Secrets stay out of the rules
Keys for the models, detectors and score vendors a rule calls are held in one place, encrypted at rest, and read only by the part of the system that makes the call.
A rule never carries a model credential — it cannot even name one. The gateway resolves it at call time.
Stored values are encrypted with AES-256-GCM, bound to the field they belong to, so a value lifted into another column does not decrypt. Rotating a key needs no migration window: keys are versioned, so a new one takes over new writes while the old one keeps reading what it wrote. Or hold the keys in your own vault.
Classification travels with the field
Declare a field sensitive once, and that governs how it is treated everywhere it appears: on an operator's screen, in what is written to the record, in an export, in a forwarded event.
The alternative is remembering to hide a column on every screen that shows it, which fails the first time someone adds a screen.
Different from redaction
Classification is about a field you own and store. Redaction is about a value on its way to a model or back from a tool.