m365-live-sensitivity-label-apply-guard

name	m365-live-sensitivity-label-apply-guard
description	Mutating-runtime live-guard for applying ONE Microsoft Purview sensitivity label to ONE specified item (file/driveItem) via the Microsoft Graph assignSensitivityLabel action. Strictly scoped — one item, one label application. Requires explicit written human approval token referencing the exact item, proposed label, and blast-radius. PREFLIGHT reads the item's current label before any write. Fully reversible — prior label captured; re-apply prior label is the rollback. Gate-only; never auto-dispatched. Phase B mutating-runtime.
allowed-tools	Read Grep Glob
metadata	{"author":"github: Raishin","version":"0.1.0","updated":"2026-06-17","category":"compliance","execution_tier":"mutating-runtime","mcp_servers":[],"oauth_scopes":["InformationProtectionPolicy.Read.All","Files.ReadWrite.All (documented least-privileged APPLICATION permission for driveItem assignSensitivityLabel; Graph exposes no per-item application scope for this protected/metered API)"],"run_as_permissions":{"required":["InformationProtectionPolicy.Read.All — to read available sensitivity labels and verify the proposed label ID (application permission, admin-consented)","Files.ReadWrite.All — the least-privileged APPLICATION permission documented for driveItem: assignSensitivityLabel (higher-privileged alternative is Sites.ReadWrite.All; neither Files.ReadWrite without .All nor Sites.Selected is a supported application permission for this API)","Application permission, admin-consented — no delegated/user-context for background agent operations"],"compensating_controls":["Because no per-item application scope exists for this API, constrain the app's effective reach OUTSIDE the Graph permission: app-only access policy / RSC, or a Sites.Selected site-level grant where the tenant supports it, plus this guard's one-item written-approval gate and PREFLIGHT diff"],"denied":["Directory.ReadWrite.All","Sites.FullControl.All","Sites.ReadWrite.All (higher-privileged alternative — Files.ReadWrite.All is the narrower documented permission for this API)","InformationProtectionPolicy.ReadWrite.All (label policy management — not permitted)","LabelPolicyManagement (any scope)","RoleManagement.ReadWrite.Directory","User.ReadWrite.All","Bulk labeling (any operation targeting more than one item)","Label policy changes (any write to label policy resources)","Removing protection that would downgrade classification without explicit approval token"]},"required_egress":["graph.microsoft.com","login.microsoftonline.com"],"requires_credentials":["GRAPH_CLIENT_ID","GRAPH_TENANT_ID"],"output_attestation":{"schema":"sensitivity-label-attestation-v1","signed_with":"idempotency-key","audit_log":"required"},"liveAgentFields":{"execution_tier":"mutating-runtime","single_op":true,"reversible":true,"requires_approval_token":true,"dry_run_preflight":true,"idempotency_key":true,"blast_radius_required":true},"companion_agents":["m365-live-sensitivity-label-apply-guard-agent"]}

M365 Live Sensitivity Label Apply Guard

Purpose

Act as the live mutating-runtime Microsoft Purview sensitivity label application guard. On receipt of an explicit written human approval token, authenticate via Microsoft Graph application permissions, capture the current sensitivity label of the target item (PREFLIGHT), and call assignSensitivityLabel to apply the ONE approved label to the ONE identified driveItem. Emit a signed, idempotency-keyed attestation and update the audit log. Reverse path is always available — re-apply the prior label.

When to use

• A single file or driveItem must have its sensitivity label upgraded or set as part of a compliance remediation
• The operation requires a human-approved, blast-radius-reviewed gate before any label write proceeds
• A prior compliance discovery identified a specific item that must be labeled to meet a data-classification policy
• Auditable, traceable label application is required for regulatory or governance purposes

Gate-only classification

This skill id contains -live- and ends in -guard. The maestro MUST NOT auto-dispatch this skill. Invocation requires:

1. An explicit written human approval token that references:
   • The target tenant (by env-var name GRAPH_TENANT_ID, not value)
   • The target drive ID and driveItem ID (or equivalent item path)
   • The proposed sensitivity label ID and label display name
   • The assignment method (standard or privileged)
   • The justification text (required for label downgrades or privileged assignments)
   • The blast-radius assessment (who/what reads or is protected by the current label; what changes with the new label)
2. Completion of PREFLIGHT (GET current label, confirm item exists, confirm scope)
3. Prior-label capture before any write

Strict-control contract

• execution_tier: mutating-runtime
• EXACTLY ONE driveItem is labeled per approved run. Target is identified by drive ID + driveItem ID.
• ONE label application — the PATCH/action body contains only the approved sensitivity label ID.
• No bulk labeling — no operation targeting more than one item.
• No label policy changes — InformationProtectionPolicy.ReadWrite.All and any label-policy write scope are explicitly denied.
• No classification downgrade without explicit approval — if the proposed label would lower the classification tier, the approval token must explicitly acknowledge the downgrade and its justification text must be present.