Skip to content

CONCEPT Cited by 2 sources

Information flow control

Definition

Information flow control (IFC) constrains not just who may access data but where data may flow once read. Data carries labels (classically points in Denning's 1977 security lattice); labels propagate through computation, and every write to a sink is checked against the sink's label. Unlike access control, IFC governs derived data and transitive flows.

Mechanics in production

  • Labels/annotations on data at table/column/row or request-parameter/return-value granularity, mapped to flow rules.
  • Propagation — the executing context (request, SQL job, call tree) inherits the labels of the data it loaded.
  • Sink checks — writes, RPCs and logs out of a labeled context are allowed, denied, or (in logging mode) recorded.

Meta's Policy Zones is the wiki's canonical production IFC system, chosen because IFC "controls not only data access but also how data is processed and transferred in real-time". (Source: sources/2024-08-31-meta-enforces-purpose-limitation-via-privacy-aware-infrastructure)

Engineering at scale

PrivacyLib is where Policy Zones' checks actually execute: in-process in >100 client libraries at billions of checks/second, with policies compiled at build time, per-request/per-host caches, withPropagation() on write paths, and a signed token so a lower RPC layer can trust the richer client-side check. The same IFC module is reused unmodified to bound AI-agent tool calls by propagating agent context to the data-access boundary. (Source: sources/2026-10-27-meta-privacylib-privacy-controls-at-the-data-access-boundary)

Seen in

Last updated · 854 distilled / 2,448 read