Most agencies have already done the work: files classified in Microsoft Purview, labels embedded into every document, policy decisions built into the data itself. Inside Microsoft, those labels work. Outside Microsoft, they stop mattering. A Confidential file uploads to ChatGPT as easily as a public one. Darwin's Sensitivity Labels Enforcement changes that.
.svg)
Most agencies have already done the hard work of classifying their data. Files marked Confidential. Documents labeled Special Handling. Records tagged Public Information. Every one of those labels represents a policy decision; this data can be shared this way, this data can't, embedded directly into the file through Microsoft Purview.
That classification works exactly as designed inside the Microsoft ecosystem. Open a Confidential document in Word, share it in SharePoint, send it through Teams: the label controls what happens. But the moment an employee drags that same file into ChatGPT, Gemini, or Claude, the label stops mattering. Every classification decision the agency has made is invisible to the AI tool receiving the file.
This is the gap Darwin's Sensitivity Labels Enforcement closes. Darwin reads the Purview label already embedded in every file and enforces the agency's classification policy at the moment of upload; across ChatGPT, Gemini, Claude, Microsoft Copilot, and Microsoft 365 Copilot Cloud. The classification investment that used to stop at the Microsoft boundary now protects data everywhere employees work with AI.
Sensitivity Labels Enforcement doesn't ask agencies to reclassify anything. Darwin syncs sensitivity labels directly from Microsoft Purview through the existing Entra integration, using the standard Graph API permission for label access. Every label the agency has already defined in Purview- Public Information, Confidential, Confidential-Special Handling, and any custom labels in between is available in Darwin the moment sync completes.
When an employee uploads a file to an AI tool, Darwin reads the label embedded in the file itself and enforces the rule in real time. No re-tagging. No parallel classification system. No new workflow for the data governance team. The years already invested in Purview classification become AI policy on day one.
Agencies don't want the same level of enforcement everywhere. A shadow AI tool discovered in an employee's browser demands stricter controls than a sandboxed tool the security team is actively evaluating. Sensitivity Labels Enforcement supports that reality with three configurable enforcement modes:
Each rule is configured per AI system category: unauthorized, authorized, sandboxed, or shadow so agencies can enforce strict blocking on the tools that need it while allowing more flexibility where risk is lower. It's granular control, not the blunt on/off switch that pushes employees toward shadow AI.
When Darwin blocks a file upload, the action doesn't disappear into a log no one checks. Every violation raises an alert in the Risk Center with full context: which user, which tool, which file, which label ready for investigation. Users who need to upload a legitimately blocked file can request an exception, giving them a sanctioned path instead of a workaround.
The result is enforcement that compliance teams can actually audit and defend. Not a policy that lives in a training document, but one that operates in real time and produces a record every time it fires.
Government and regulated agencies have invested years in building classification schemes that reflect their compliance obligations. Darwin's Sensitivity Labels Enforcement makes that investment count for AI, turning a Microsoft-only control into a universal one, and giving security teams the extension they need without asking data governance to start over.
Ready to see Sensitivity Labels Enforcement in action? Book a demo or reach out to your Darwin AI contact to get a walkthrough.
.png)