TAOM information protection
Not just who may log in. But what someone may do with a process.
Your most valuable corporate knowledge is in your processes. TAOM protects it – down to the individual process step.
How a sterile fill, access to a restricted zone or an approval works in detail is know-how – and sometimes a security risk. TAOM classifies models and individual steps, passes the level on to everything derived from them and enforces on the server who – and which AI agent – may see, edit and output them.
Available from Webuser Pro · Feature matrix
What TAOM does differently
One governance logic instead of many individual switches
Many enterprise platforms have roles and rights. TAOM connects four things that are otherwise governed separately – and checks them in one place on the server.
Four levels, two layers
The model sets the minimum level; the step can be higher
A model’s classification applies to each of its steps. Individual steps can be classified higher – directly or via a compliance requirement. The highest level always applies.
Example
Why a process model itself needs protection
A reference model from the defence sector (fictitious, transferable to a cleanroom or high-security laboratory): access to security areas. The model shows which zones exist, who checks what, where four-eyes approvals are – and therefore also where the weak points are. That is exactly why it is “Strictly confidential”.
Visible at the step
The lock shows the effective level of each step – inherited from the model, raised at the step or set via a compliance requirement.
Risks where they arise
Severity, probability, detectability and controls are attached to the step – and inherit the same classification.
Without clearance, only the number
Anyone without the level sees in the enterprise model only “Model (Strictly confidential)” – structure and number, no content.
Security model
Eight layers, one consistent rule
For enterprise architecture and information security: where each protective function takes effect – and who sets it.
Inheritance
Everything derived from a model inherits its classification
Otherwise you could simply read a confidential model through the test evidence or reporting. That is why TAOM checks in one central place – and every function that accesses a model goes through this check.
Test management
Test cases, test runs, defects, test evidence and test plans – models above the clearance level do not appear. Testing and verification
Documents
User manual and test evidence carry classification and mark on the cover page or header.
Reporting
Cross-model analyses leave such models out and state how many are hidden. Reporting
Process mining
Times at the step belong to the step – and therefore to its level. Process mining
Project times
Effort per step follows the same rule.
Enterprise model
Structure and number remain visible so that gaps in the map can be seen – the content does not.
Outputs
Every output is governed – and carries a mark
Per level and output type the customer decides: allowed, only with a right, or blocked. The server decides – a button in the browser alone opens nothing.
| Output type | What it carries |
|---|---|
| BPMN file | Classification and export note signed in the provenance seal, event “export” in the file history |
| PDF, HTML, presentation | Classification in the header, mark in the footer |
| User manual, test evidence | Classification and mark on the cover page or above the title |
| Viewer link and embedding | Banner with classification; if “blocked”, no display, not even via a signed address |
| Jira, Confluence, SAP Cloud ALM | Check before every transfer; label and first line in the issue, warning box at the top of the page |
| Teams and Slack channels | Content reduced according to classification; if “blocked”, no message |
Classification: Confidential · exported by m.muster on 04.11.2026 13:41 as PDF · EX-261104-7F3A2C
Every attempt is recorded in the model’s export log – including rejected ones, with the reason. The classification is signed in the file: anyone passing a model on sees immediately that it is confidential, and the seal check shows whether anyone has tampered with it.
People, guests and AI agents
The customer’s administrator decides – not TAOM
Whoever buys the licence is the administrator and manages it. They set clearance level and rights per person, the default for guests from other companies and what AI agents may see. TAOM supplies templates and enforces the decision on the server.
Clearance level and rights
Per person the highest level they may work at, and separate rights: output Confidential, output Strictly confidential, invite guests, information protection report, use AI agents. Anyone below cannot open or output a model – nor downgrade the classification.
Guests from other companies
A default entry defines up to which level guests may join by invitation and which rights they have. Template: at most Confidential, and only if the inviting person has the right to do so. If a model is classified higher, access lapses.
AI agents like people
Every agent is listed with its own clearance level – created automatically so it is not forgotten. An agent never sees more than the person who starts it. Whether classified content goes to AI is the customer’s decision; the classification alone does not block an agent.
Reporting & times
Information protection belongs in the report – not in a footnote
In reporting, classification stands on equal footing with times, tests and risks: as a tile, a pie chart, a heatmap column and a report of its own. A click on a level filters all views – and leads on into the model.
Project times
Own time type “Information protection / security”: the extra effort for classifying, approving and checking is recorded as plan and actual – visible instead of hidden.
Process mining
Own time type “Security and approval time” per case – in time shares, lead time and heatmap. This makes measurable what protection costs in the process.
Only with a right
The information protection report requires a right of its own. Anyone without it sees a lock – and models above their own clearance are missing from all analyses, with a counter.
Information protection as a measurable process
Ensure security – and show what it costs
Because classification, times and log are attached to the same process step, information protection becomes a KPI: how much is protected, where content leaves the company and how much effort protection causes in the process.
Share of classified models and steps per level.
Allowed outputs from Confidential – and per model in the export log with type, person and number.
Share of rejected accesses and outputs in all attempts.
Time type “Security and approval” per case – mean, median, peaks.
How often levels are changed – an indication of unclear rules.
Project time type “Information protection” as plan and actual, plus the security time in the process.
Evidence
The permission logic is tested itself
The rules are described as processes in TAOM’s enterprise model and backed by test cases – including negative cases: opening without clearance, output without a right, a guest on a strictly confidential model, saving with redacted steps, an AI agent without a right. The tests ran live on taom.ai; gaps they found were closed and retested. Every rejection is in the log under “Important”.
Information protection report
In reporting: classification per step with reason, outputs per level, export log and guests – only with its own right.
Log
Changes to clearance levels and classification, every output and every rejection – with person and time.
Seal
Classification and export note are part of the model file’s signature and visible on the verification page.
Part of the whole
A change to a process step – all consequences in view
The strength does not lie in the individual function, but in everything being attached to the same step: requirements, tests, approvals, risks – and information protection.
If a step changes, TAOM shows at the step
- which requirements are attached to ittoday
- which test cases and evidence are affectedtoday
- which approvals are needed again (four-eyes, version)today
- which risks must be reassessedtoday
- which content must remain protectedtoday
- which people and AI agents may change ittoday
Change impact analysis
One click in the editor compares the state with the valid version and lists, for every changed step, the affected requirements, tests, risks and approvals – with a proposal for which tests must run again and which ratings need review. Filtered by what the editing person may see.
today
With Change Impact Management additionally as an Impact Score, effort internal and external and costs only with a separate right – staff costs remain protected.
More about consequences of change → · Change Impact Management →
Information protection
Model critical processes without exposing them
For GxP, defence, security service providers and everyone whose processes themselves need protection.