tiCrypt

How Project Tags Work

TL;DR

• Project: limits who can use the resources tagged with it. Only active members of the project can use them
• Membership is not access: a member still needs access to each resource. They must own it, have it shared with them, or be added to it
• Active: a current member who holds every certification the project's security level requires. tiCrypt checks this at sign-in
• Tag changes: Classify moves a tag to a stricter subproject, Declassify moves it up, and Set moves it anywhere
• Jump to the scenarios

Related pages

For the steps, see Change Project for files and folders, Projects and Quotas for virtual machines, and Admin Guide: Projects for creating projects and managing members.

What a Project Is

In tiCrypt, a project limits who can use the resources tagged with it. A project has a name, a tag of up to 8 characters, a list of members, and an optional security level.

A project tag puts a resource in one project. Files, folders, inboxes, groups, drives, and virtual machines can be tagged. A resource has one tag or none. An untagged resource is in No project and has no project restriction.

A project restricts access. It does not grant it. To use a tagged resource, a user needs both of the following:

Requirement	Met when
Access to the resource	The user owns it, it was shared with them, or they were added to the group or virtual machine.
Active in the project	The user passes the three project checks.

Neither requirement is enough by itself:

• A project member cannot open a colleague's tagged file that was never shared with them.
• A user who is not in the project cannot open a tagged file shared with them.
• A system role makes no difference. An Admin or Super-admin who is not active in the project cannot use its resources.

The Project Tree

Projects can have subprojects. A subproject's members must also be members of its parent, and the subproject can have its own security level. No project is the top of the tree. The examples on this page use this tree:

No project
├── Artemis               tag ARTEMIS    Shared mission data
│   ├── Artemis Medical   tag ART-MED    Crew health records, medical clearance
│   └── Artemis Samples   tag ART-SAMP   Lunar samples, curation clearance
└── Europa Clipper        tag CLIPPER    A separate mission

• Down the tree is stricter. Artemis Medical is stricter than Artemis, and Artemis is stricter than No project. Data can move down with Classify.
• Siblings and unrelated projects are separate. Artemis Medical and Artemis Samples are siblings. Artemis and Europa Clipper are unrelated. Neither project in a pair is stricter than the other, so only Set moves data between them.

When You Are Active in a Project

tiCrypt decides which projects are active for you when you sign in. A project is active when all three checks pass:

Check	Passes when
1. Membership	You are a member of the project.
2. Expiration	Your membership has no expiration date, or the date has not passed.
3. Certifications	The project has no security level, or you hold an unexpired certification for every security requirement of its level.

tiCrypt runs these checks when you sign in, so after a fix, sign in again. A project with no security level passes check 3.

Each project is checked separately. Being active in Artemis does not make you active in Artemis Medical, which can require certifications that its parent does not.

A project that fails a check is locked for the whole session. It shows a lock in the project picker, and tiCrypt refuses every action on resources tagged with it.

When Changes Take Effect

Change	Takes effect
You are added to a project, or a new project is created for you	At your next sign-in
You are granted or renewed a certification	At your next sign-in
Your membership or a certification expires	At your next sign-in. A session that is already open keeps the project until you sign out
You are removed from a project	At once, in every open session
A file, folder, group, or drive is re-tagged	At once
A virtual machine is re-tagged	When the virtual machine restarts

Roles and Restrictions

Each membership has a role and a restriction. Both are set when the member is added, and Edit on the membership changes them.

• Regular member: can classify resources they own into the project.
• Manager: can also declassify resources out of the project, with the Remove project tags of projects they manage permission. A project Manager is not a Sub-admin. Managing members and certifications needs the Project Management or Project Administration permissions described in Admin Guide: Projects.

Restriction	View tagged files in the browser	Download tagged files
No restrictions	Yes	Yes
Cannot download	Yes	No
Cannot download, cannot view	No	No

Common Scenarios

Each row uses a resource tagged Artemis Medical. The first column is the user's status in Artemis Medical.

Virtual Machines

User's status in the project	Action	Result
Not a member	Added to the virtual machine	Cannot connect. The virtual machine appears in their list but is locked. The user picker marks them "No active membership in this VM's project".
Member, not active	Added to the virtual machine	Cannot connect until the membership or certification is renewed and they sign in again.
Active member	Not added to the virtual machine	Cannot connect. Project membership does not give access to a virtual machine. The owner or a manager of the virtual machine must add them.
Active member	Added to the virtual machine	Can connect.
Active member	Removed from the project	Cannot connect. New connections are refused at once.
Not active	Starts the VM configuration	Cannot start. tiCrypt shows "Your membership is not active in this VM configuration's project".
Admin or Super-admin, not a member	Connects to the virtual machine	Cannot connect. A system role does not replace project membership.

For the steps, see Add Users to a Virtual Machine.

Files, Groups, and Drives

User's status in the project	Action	Result
Not a member	Receives a share of the file	Cannot open, preview, or download. The share is saved and works once they are active in the project.
Not a member	Added to the group	Cannot open the group's files. The dialog warns that the user has no active membership in the group's project.
Not a member	Receives a share of the drive	Cannot attach the drive. The share is saved and works once they are active in the project.
Active member	Uploads a file into the folder	Allowed. The file is tagged Artemis Medical.
Active member, Cannot download restriction	Downloads the file	Refused. Viewing the file in the browser still works.
Active member	Transfers the file from the Vault into a virtual machine	Allowed only into a virtual machine tagged Artemis Medical or one of its subprojects. Any other virtual machine skips the file.
Active member	Transfers a file from a virtual machine tagged Artemis Medical to the Vault	Allowed. The file is tagged Artemis Medical.

Summary by Status

Action on a resource tagged Artemis Medical	Not a member	Member, not active	Active member	Active Manager	Holds Tag anything with any project, not a member
Use it: open, upload, share, attach, or connect¹	No	No	Yes	Yes	No
Classify what you own into Artemis Medical	No	No	Yes	Yes	Yes, with Set
Declassify to Artemis or No project	No	No	No	Yes	Yes, with Set
Move to Artemis Samples or Europa Clipper	No	No	No	No	Yes, with Set

¹ The user also needs access to the resource, and the member's restriction applies.

Every action also needs its usual system permission, such as the permission to download files or attach drives. Project rules apply on top of system permissions and never replace them.

Changing a Tag

Change project offers three operations. The dialog picks Classify or Declassify from the project you choose. It uses Set only when you tick Use my permission to override rules, re-tag resources with any visible project, regardless of current project relations.

Operation	Button	Moves the tag	You need
Classify	Classify	Down: from No project to any project, or from a project to one of its subprojects	The Tag what they own with a project they are active in permission, to be active in the new project, and to own the resource (for a group or group folder, the group's Change Project permission also works)
Declassify	Declassify	Up: to the parent, another ancestor, or No project	The Remove project tags of projects they manage permission, to be an active Manager of the current project, and to be active in the new project
Set	Force change with admin privilege	Anywhere, including to a sibling or an unrelated project	The Tag anything with any project permission. No membership is needed

Classify (down, stricter): any active member, on what they own. Declassify (up, less strict): an active Manager of the current project. Set (anywhere, including sideways): only with the Tag anything with any project permission.

Without Set, a sideways move takes two steps. A Manager of Artemis Medical who is also active in Artemis Samples declassifies to Artemis, then classifies to Artemis Samples.

The tiCrypt audit log records all three operations, including which one was used. For changing several items or a whole folder at once, see Change Project.

How Each Resource Gets a Tag

Resource	How it gets a tag	Who can classify it	Where the tag is checked
File	Uploading into a tagged folder gives the file the folder's tag. Change project changes it later	The file's owner	Opening, previewing, downloading, sharing, and changing the file
Folder	A new folder takes its parent's tag. Change project changes it, recursively by default	The owner, or for a group folder, a group member with the group's Change Project permission	Opening the folder, uploading into it, and moving items into it
Inbox	Change project on the inbox folder. Every delivery, and the files inside it, take the inbox's tag	The owner of the inbox folder	The same checks as a folder. Senders need no project access
Group	Chosen when the group is created, or changed with Change project. The group's top folder carries the group's tag	The group owner, or a member with the group's Change Project permission	Getting the group key, which members need to read files shared with the group
Drive	Chosen when the drive is created. Read-write drives follow their virtual machine when its project changes	The drive owner	Getting the drive key and attaching the drive
Virtual machine	The Project field of the VM configuration, or Change Project	Users with Edit any VM configuration, or the configuration's owners through Edit	Connecting, and attaching drives. The tag applies from the next start

Drives and Virtual Machines

Data can move into a stricter virtual machine but never out of it. A read-only drive can carry the virtual machine's tag or a less strict tag above it. A read-write drive must carry exactly the virtual machine's tag. You must also be active in the projects of both the drive and the virtual machine.

VM tag	Drive tag	Attach read-only	Attach read-write
Artemis Medical	Artemis Medical	Yes	Yes
Artemis Medical	Artemis (parent)	Yes	No
Artemis Medical	No project	Yes	No
Artemis Medical	Artemis Samples (sibling)	No	No
No project	Artemis Medical	No	No
No project	No project	Yes	Yes

Data can move into a stricter machine, never out of it. Only a drive with exactly the VM's tag attaches read-write.

Changing the project of a virtual machine re-tags its read-write drives with it. Read-only drives keep their own tag.

Hosts can also be reserved for projects. A host whose Access whitelist lists a project runs that project's virtual machines first, and a host whose whitelist does not match is not used at all. See Libvirt Hosts.

Membership Rules for Subprojects

• Joining a subproject requires the parent. A user must be a member of Artemis before they can join Artemis Medical. When you add users to a subproject, tiCrypt first adds them to every ancestor they are missing from, with the same role and expiration.
• Leaving a parent requires leaving its subprojects first. tiCrypt refuses to remove a user from Artemis while they still belong to Artemis Medical or Artemis Samples.
• A project in use cannot be deleted. Remove its members and delete its subprojects first.
• Removing a member ends their access at once. They can no longer open files, get drive or group keys, attach drives, or connect to virtual machines tagged with the project.

Troubleshooting

What you see	Why	What to do
A project shows a lock in the project picker	You are not active in it: a certification is missing or expired, or the membership expired	Ask a Manager of the project or your administrator to renew the certification or membership, then sign in again
A newly created project, or one you just joined, is missing	Active projects are decided at sign-in	Sign in again
A file or virtual machine shared with you is locked	You are not active in its project	Ask a Manager of the project to add you, check your certifications, then sign in again
Declassify fails	You are not a Manager of the current project, or not active in it	Ask a Manager of the project to declassify it
You cannot pick a sibling or unrelated project	Only Set moves a tag sideways	Ask someone with Tag anything with any project, or declassify then classify if you manage both projects
A drive will not attach read-write	Its tag is not exactly the VM's tag	Attach it read-only, or tag the drive and the VM with the same project
A new VM tag has no effect	The tag applies when the machine starts	Restart the virtual machine