An NDMO-Inspired, SAMA-Aware, Human-Gated Classifier for Saudi Banking Metadata
Auditable, impact-driven, sovereign-by-design. A policy-grounded, deterministic classification and decision-support artifact that proposes a security level only where a policy-cited rule supports one, records the impact reasoning behind every proposal, declines to label what it does not recognise, and routes every declined or high-stakes field to a human reviewer.
What the artifact does
Saudi commercial banks answer to SAMA, whose Cyber Security Framework requires an information-asset classification scheme but does not prescribe one. The NDMO four-level scheme is a well-specified template a bank may adopt, and the PDPL applies directly. The artifact adopts NDMO's four-level, four-dimension impact model as a SAMA-regulated bank's lawful choice — it does not claim NDMO jurisdiction over banks — and treats PDPL obligations as directly binding.
For every metadata field it runs four steps, then decides whether a human must look:
1Detect
Match the field name and its description against sixteen policy-cited rules. Matching is boundary-aware: a pattern must equal a whole token or a complete phrase, never a substring.
2Profile impact
Rate the four NDMO dimensions — national interest, entity activities, individuals, environment — from the winning rule.
3Derive the level
Level = the maximum impact rating. Tables inherit the highest level of their columns (Principle 4). When rules conflict, the more protective level wins.
4Ground
Emit the level, the impact vector, and the policy clause relied on — so a regulator's "why was this Secret?" has a citation, not institutional memory.
Abstain rather than guess
An unrecognised field is not assigned a level. It is returned Unclassified with interim Restricted handling under NDMO §1.4 and always gated.
Human gate
A Business Data Executive confirms or overrides every flagged field: Top Secret candidates, low-assurance rules, §1.4 defaults, AI-detected categories, name-based PDPL candidates.
PDPL on its own axis
Personal, Sensitive and Credit Data flags are derived independently of the winning rule. They annotate a field; they never change its level, because a security level and a statutory category answer different questions.
Optional AI detector — off
Can only propose a category for an unmatched field, never a level, and its output is always gated. It was off in every experiment reported, and it is not part of this site.
What the paper claims — and what it does not
The evaluation separates classification quality from workflow safety, because an abstention is not a prediction. Read as the paper asks it to be read:
Established. A conservative, auditable workflow whose rules are precise where they fire, whose under-classifications surface to a human rather than pass silently at every gate threshold tested, and whose binding limit is coverage. The adversarial probe shows why that matters: the earlier substring matcher looked perfect on the synthetic corpus and failed 14 of 19 adversarial cases.
Not established. Every security-level reference label is author-assigned, so no level figure is independently validated — the 99.4% agreement on the 200-column synthetic corpus is rule conformance, not accuracy. On external metadata 81.7% of fields still need a human. And the PDPL flag mechanism is incomplete: its Credit Data limb missed all 18 independent reference positives, an entire statutory category. These results validate the design and its evaluation protocol; they do not establish operational readiness for banking deployment.
Tools
Live classifier
Classify one field or paste a whole schema. Every output of Algorithm 1: level, impact vector, citation, PDPL flags, gate decision, and the full match trace.
Open →Adversarial probe
The paper's clearest methodological point, runnable: 19 lexical-collision and compound-field cases against the corrected and the pre-correction matcher, side by side.
Open →Results explorer
Tables II–IV, the ablations, the gate-threshold sensitivity sweep, the per-field Fineract test, and the plain-language metric glossary — read from the artifact's own result files.
Open →Rules & patterns
The complete rule inventory and all 243 field-name patterns (plus 33 description patterns), collision-prone ones marked — the engine's entire scope, auditable without running code.
Open →Sovereign by design, literally. The classifier on this site runs entirely in your browser. Field names and descriptions you enter never leave your machine — the deployment model the paper describes, with nothing to trust but the page you can view-source.
Cite
R. Kamsheh, "An NDMO-Inspired, SAMA-Aware, Human-Gated Classifier for Saudi Banking Metadata: Auditable, Impact-Driven, Sovereign-by-Design," in Proc. 6th Int. Multi-Conf. Artificial Intelligence Technology (MCAIT), Madinah, Saudi Arabia, Nov. 2026.
Proceedings DOI and page numbers will be added once IEEE Xplore publishes the volume.