Excellent question - retention policy is more nuanced than classification. Our system uses a decision matrix combining multiple factors:
Machine Learning Classification:
The ML model assigns initial sensitivity classification (Public, Internal, Confidential, Restricted) by analyzing article content, metadata, and contextual signals. Training data includes 5,000 pre-classified articles with balanced representation across sensitivity levels and content types. Feature extraction uses TF-IDF text vectorization, article category, product associations, author department, keyword detection (customer names, financial terms, proprietary technology), and historical access patterns. The gradient boosting classifier achieves 94% accuracy, with uncertain classifications (confidence score below 85%) flagged for human review.
Automated Tagging Framework:
Based on ML classification, the system automatically applies governance tags: data-classification (Public/Internal/Confidential/Restricted), content-type (troubleshooting/policy/product-guide/security-advisory), regulatory-scope (GDPR/HIPAA/SOX/none), and product-lifecycle-stage (active/maintenance/end-of-life). Tags drive downstream governance actions including access control and retention policies. Tagging happens within 2 minutes of article publication, compared to 3-7 days with manual classification.
Access Control Enforcement:
Access restrictions apply automatically based on classification tags. Public articles: accessible to all users including customers. Internal articles: restricted to employees only. Confidential articles: restricted to specific departments with 24-hour data steward review before enforcement. Restricted articles: require explicit user authorization with mandatory review. We use Oracle CX’s role-based access control integrated with our classification tags. Permissions update automatically when classification changes, maintaining governance consistency.
Retention Policy Application:
Retention rules combine classification with contextual factors: article age, product lifecycle status (active products = 7-year retention, end-of-life products = 2-year retention then archive), usage frequency (frequently accessed articles extended retention), and regulatory requirements (GDPR-tagged articles = 6-year retention, SOX-tagged = 7-year retention). The system calculates a composite retention period and schedules automatic archival or deletion. Data stewards receive notifications 60 days before scheduled deletion for final review.
Model Feedback Loop:
Critical for maintaining accuracy - when data stewards override ML classifications during review, we capture the correction as training data. The model retrains monthly incorporating feedback, continuously improving accuracy. Initial deployment accuracy was 87%, improved to 94% after 6 months of feedback-driven retraining. We also track classification drift - if accuracy drops below 90%, it triggers manual review of recent articles to identify new content patterns requiring model updates.
Implementation Architecture:
Built on Oracle CX’s custom object framework with integration to Oracle Machine Learning services. Article publication triggers a real-time classification API call. Classification results write to custom governance fields on the Knowledge Article object. Scheduled jobs run nightly to apply retention policies and archive expired articles. Audit logs capture all classification decisions, policy applications, and human overrides for compliance reporting.
This comprehensive automation reduced manual classification effort from 40 hours weekly to 6 hours (85% reduction), eliminated tagging backlogs, achieved 100% governance compliance, and provided complete audit trails for regulatory reviews. The key success factor is the feedback loop - the model continuously learns from human corrections, maintaining high accuracy as content evolves.