Data Inventory

Outcome: Learn how data labels are assigned, locked, and automatically classified during discovery.

Overview

Formal automatically discovers and catalogs databases, schemas, tables, and columns across your infrastructure. The data inventory gives you visibility into what data exists, where it lives, and how sensitive it is. The inventory is populated by the Data Discovery Satellite, which scans your on a schedule. During each scan, columns can be automatically classified with data labels that identify sensitive data types.

List Available Labels

Formal has two places to see available data labels.

Built-in labels: Open Data Inventory and select a column label. The picker shows the built-in labels available for manual assignment.
Custom labels: Open Data Inventory and click Labels to list and manage the custom labels created for your organization.

You can also list custom labels with the ListDataLabels API.

Discovery

The Data Discovery Satellite connects to your resources and catalogs their structure:

Databases and schemas
Tables and views
Columns with data types

Configure discovery schedules per resource with options for frequency (every 6, 12, 18, or 24 hours, or custom cron) and deletion policy for removed schemas. See Satellites for deployment and configuration.

Data Labels

Data labels identify the type of sensitive data in a column or field (e.g., email_address, ssn, phone_number). Use labels in to enforce masking, filtering, and access control based on data sensitivity. Formal ships with built-in labels and supports custom labels with automatic matchers. During discovery, the Data Discovery Satellite applies those matchers to assign labels without manual work.

Built-in Labels

These labels are available in the Formal console label picker.

Personal and Sensitive Data

Label	Identifier
Date/Time	`date_time`
Email Address	`email_address`
Height	`height`
IP Address	`ip_address`
Location	`location`
Passport Number	`passport_number`
Person Gender	`gender`
Person Name	`name`
Phone Number	`phone_number`
Social Security Number	`ssn`
Weight	`weight`

Healthcare

Label	Identifier
Blood Type	`blood_type`
Diagnosis	`diagnosis`
Drug Code	`drug_code`
Drug Name	`drug_name`
Health Insurance Number	`health_insurance_number`
Health Plan Type Name	`health_plan_type_name`
Medical Record Number	`medical_record_number`
Treatment Type	`treatment_type`

Financial

Label	Identifier
Bank Account Number	`bank_account_number`
Credit/Debit Card Number	`credit_card_number`

Credentials

Label	Identifier
Password	`password`

Custom Labels

Custom labels are labels your organization creates for its own data types. They appear in Labels and in the label picker.

Inventory Path

Every object in the inventory has a path that identifies where it lives. Paths are dot-separated strings built from database hierarchy:

Object type	Path format	Example
Database	`database`	`app`
Schema	`database.schema`	`app.public`
Table	`database.schema.table`	`app.public.customers`
Column	`database.schema.table.column`	`app.public.customers.email`

The path does not include the name. Formal stores the resource separately on each inventory object. Regex label matchers run against the column path only. They do not inspect row values.

When Labels Are Classified

Formal assigns labels in three ways: During scheduled discovery. When the Data Discovery Satellite lists columns for a table, it runs automatic classifiers before writing results to the inventory. Discovery schedules are configured per resource (every 6, 12, 18, or 24 hours, or a custom cron). Manually in the console. In Data Inventory, select a column and choose a label from the dropdown. Through the API or Terraform. Use the inventory APIs or formal_inventory_object_data_label_link to set labels programmatically. Automatic classification only runs during discovery scans. On each scan, discovery re-runs matchers and can assign or update labels on unlocked columns. Locked columns keep their current label. Saving a matcher edit in Labels does not change any column labels by itself. The updated matcher takes effect on the next discovery scan—for unlocked columns only. Lock a column if you want to keep its label even after you change matchers.

Label Locking

Locking is a per-column setting. It controls whether scheduled discovery scans can change that column’s label. Locking only matters once a column already has a label. It prevents discovery from overwriting that label on future scans. Unlabeled columns get labels on the next scan regardless of lock state.

	Unlocked	Locked
Column already has a label	Discovery can update the label on the next scan if matchers produce a different result	Discovery keeps the current label; scans do not overwrite it
You change the label manually or via Terraform	Allowed	Allowed

Lock a column when you have set the label yourself and do not want discovery to change it on future scans.

Open Data Inventory and select a column.
Turn on Lock Label in the Classification section.

Filter locked columns in the inventory toolbar with the Locked filter.

Automatic Classification

Create custom labels from Data Inventory → Labels. Each label uses a matcher that tells discovery how to classify columns. Discovery evaluates matchers in two stages:

Regex matchers run first against the column inventory path.
Prompt matchers run on columns that regex did not match.

Regex Labels

Regex labels match column paths with a regular expression. They do not read row values.

Setting	Value
Matcher type	Regex
Pattern	A regular expression tested against `database.schema.table.column`

Example: the pattern (^|\.)email$ matches app.public.customers.email and warehouse.staging.users.contact_email. Regex labels work with only the Data Discovery Satellite deployed. No AI Satellite link is required.

Prompt Labels

Prompt labels use natural language to classify columns from metadata and sampled data.

Setting	Value
Matcher type	Prompt
Prompt	A description of when the label applies, for example “Columns containing personal email addresses”

For each unmatched column, discovery samples up to 10 row values from the table. The classifier receives the column name, data type, and those samples. It does not scan every row in the table. Prompt labels require:

A deployed Data Discovery Satellite
At least one prompt label in Labels
An LLM backend for classification (see below)
A with SELECT permission on the tables being scanned. Discovery uses this credential to read sample rows.

You do not need an AI Satellite for prompt labels. Choose one backend: AWS Bedrock (no AI Satellite). Set this environment variable on the Data Discovery Satellite:

DATA_DISCOVERY_LABELING_USE_BEDROCK=true

Discovery then calls Amazon Bedrock directly using the container’s AWS credentials (for example, an ECS task role). Grant the role bedrock:InvokeModel access to the Claude Haiku inference profile in your account and region. See Prompt Classification Backends for a full deployment example. AI Satellite. Deploy and link an AI Satellite to the Data Discovery Satellite. Use this option when you want classification to run in your own infrastructure instead of calling Bedrock. If sampling fails (for example, missing SELECT permission), regex labels still apply. Prompt labels are skipped for that table.

Manual Label Management

Use Labels in the Formal console to create, edit, and delete custom labels. You can also manage labels with the ListDataLabels API or the Terraform formal_data_label resource.

Use Labels in Policies

Reference labels in to enforce data-sensitive access control. Labels are available via col["data_label"].

package formal.v2

import rego.v1

default response := {"action": "allow"}

# Mask any column labeled as email_address
response := {"action": "mask_value"} if {
  col := input.row[_]
  col["data_label"] == "email_address"
}

package formal.v2

import rego.v1

default response := {"action": "allow"}

# Mask multiple sensitive label types
response := {"action": "mask_value"} if {
  col := input.row[_]
  col["data_label"] in ["email_address", "ssn", "phone_number"]
}

See Policy Examples for more patterns.

Next Steps

Deploy Satellites

Set up AI and Data Discovery Satellites for automatic classification

Write Policies

Use labels to enforce masking and access control

Policy Examples

See real-world policies using data labels

Terraform Provider

Manage labels and inventory as code

Getting Started

Configuring Formal

Leveraging Formal

Integrations

Configuration

Client Apps

Example Use Cases

Overview

List Available Labels

Discovery

Data Labels

Built-in Labels

Personal and Sensitive Data

Healthcare

Financial

Credentials

Custom Labels

Inventory Path

When Labels Are Classified

Label Locking

Automatic Classification

Regex Labels

Prompt Labels

Manual Label Management

Use Labels in Policies

Tags

Next Steps

Deploy Satellites

Write Policies

Policy Examples

Terraform Provider

​Overview

​List Available Labels

​Discovery

​Data Labels

​Built-in Labels

​Personal and Sensitive Data

​Healthcare

​Financial

​Credentials

​Custom Labels

​Inventory Path

​When Labels Are Classified

​Label Locking

​Automatic Classification

​Regex Labels

​Prompt Labels

​Manual Label Management

​Use Labels in Policies

​Tags

​Next Steps

Deploy Satellites

Write Policies

Policy Examples

Terraform Provider

Overview

List Available Labels

Discovery

Data Labels

Built-in Labels

Personal and Sensitive Data

Healthcare

Financial

Credentials

Custom Labels

Inventory Path

When Labels Are Classified

Label Locking

Automatic Classification

Regex Labels

Prompt Labels

Manual Label Management

Use Labels in Policies

Tags

Next Steps