feat(classification): org data classification scheme, tactic-based initial default, operator edit rights

backend/app/routers/tests.py

@@ -41,8 +41,8 @@ from sqlalchemy.orm import Session
 # Import get_db from app.database
 from app.database import get_db
 
-# Import get_current_user, require_any_role, require_role from app.dependencies.auth
-from app.dependencies.auth import get_current_user, require_any_role, require_role
+# Import get_current_user, require_any_role from app.dependencies.auth
+from app.dependencies.auth import get_current_user, require_any_role
 
 # Import UnitOfWork from app.domain.unit_of_work
 from app.domain.unit_of_work import UnitOfWork
@@ -86,6 +86,7 @@ from app.services.webhook_service import dispatch_webhook
 from app.services.test_crud_service import (
     create_test as crud_create_test,
 )
+from app.services.test_crud_service import determine_initial_classification
 
 # Import  from app.services.test_crud_service
 from app.services.test_crud_service import (
@@ -553,9 +554,14 @@ def update_test_classification(
     # Entry: db
     db: Session = Depends(get_db),
     # Entry: current_user
-    current_user: User = Depends(require_role("admin")),
+    current_user: User = Depends(require_any_role(
+        "admin", "manager", "red_tech", "red_lead", "blue_tech", "blue_lead",
+    )),
 ) -> TestOut:
-    """Update the data classification label for a test (admin only).
+    """Update the data classification label for a test.
+
+    The initial classification is a best-effort default based on the
+    technique's tactic — any test participant or admin can correct it.
 
     Args:
         test_id (uuid.UUID): Primary key of the test to classify.
@@ -1787,6 +1793,7 @@ def import_rt(
                 # validation_status pending so Blue Lead must confirm
                 detection_result=detection_result,
                 blue_validation_status=None,
+                data_classification=determine_initial_classification(technique),
                 # Timing
                 execution_date=exec_date_str,
                 created_at=datetime.utcnow(),