Most records systems ship with three sensitivity levels: public, internal, confidential. That covers a corporate filing cabinet. It does not cover the material an Indigenous government actually holds.

So there is a fourth tier: Sacred. It is not a stronger version of confidential. Confidential material is restricted because disclosure would cause harm to an individual or to the organisation. Sacred material is restricted because the community's own law says who may hold it, who may see it, and in what circumstances. Those are different questions, and collapsing them into one label is how systems end up making decisions they have no standing to make.

The tier is not decoration. Sensitivity is part of the metadata, so it travels with the record rather than living in someone's memory. Search is filtered by permission before results are returned, which means a person does not see a title, a snippet or a hit count for something they are not entitled to see. There is no discovery through the back door.

Who sets the tier is the important part. The entity does. We do not classify a community's records, and we do not hold a view about what belongs in the fourth tier. Our job is to make the distinction hold once it has been made by the people with the standing to make it.

This is also why our own access is built the way it is. Support access is named, scoped, logged and revocable by the customer, and we hold no standing administrative access. A tier that a vendor can quietly step around is not a tier at all.