Environment classification determines which resources are evaluated for compliance and which are excluded from scope. Every resource in LowerPlane — repositories, cloud resources, servers, and other assets — can be classified as Production or Non-production.

​
Why Classification Matters

Compliance frameworks require organizations to identify and protect production systems that handle sensitive data. Non-production systems (development, staging, testing) typically have relaxed controls and should not inflate or deflate your compliance scores. LowerPlane uses classification to:
  • Scope test evaluation — Non-production resources have their test entities marked as out-of-scope, so they do not affect pass/fail rollups.
  • Satisfy classification controls — Tests like “Code repo should be classified” pass when environment is set.
  • Provide auditor clarity — Auditors can see which resources are in scope and which are excluded, with clear justification.

​
How It Works

Production

Fully evaluated against all compliance tests. Test results count toward your compliance scores.

Non-production

Test entities are created but marked in_scope = false. They appear in the UI with an exclusion badge but do not affect compliance scoring.

​
Setting Classification

​
Manual Classification

You can classify any resource from its detail page:
  1. Navigate to the resource (repository, asset, or cloud resource).
  2. Click Edit in the Classification section.
  3. Select Production or Non-production.
  4. Click Save.
For repositories, you can also set the Default Branch used for branch protection checks.

​
Bulk Classification

Select multiple resources from the list view and click Set Classification to classify them all at once.

​
Automatic Detection from Tags

When resources are synced from cloud integrations, LowerPlane inspects resource tags for environment indicators. If a recognized tag is found, the environment is set automatically on first sync.

​
Recognized Tag Keys

Any of these tag keys (case-insensitive) are checked: env, environment, stage, tier, lowerplane, deployment, deploy_env, deploy-env, app_env, app-env

​
Recognized Tag Values

Tag ValueClassification
production, prodProduction
staging, stage, stgNon-production
development, devNon-production
testing, test, qa, uatNon-production
sandbox, demoNon-production
non-production, non_production, nonproductionNon-production
All values are matched case-insensitively.

​
Examples

TagDetected Environment
{"Env": "Production"}Production
{"environment": "staging"}Non-production
{"lowerplane": "prod"}Production
{"stage": "QA"}Non-production
{"deploy_env": "PRODUCTION"}Production
{"tier": "sandbox"}Non-production
Automatic detection only sets the environment when it is currently unset. It never overwrites a manually set classification. If you change a resource from production to non-production (or vice versa) in the UI, subsequent syncs will preserve your choice.

​
Effect on Test Entities

When a resource is classified as non-production, LowerPlane handles test entities as follows:
ScenarioBehavior
New test entity for non-production resourceCreated with in_scope = false, excluded from rollup
Existing entity, resource changed to non-productionUpdated to in_scope = false on next sync
Existing entity, resource changed back to productionRestored to in_scope = true on next sync
User manually excluded an entityPreserved — automatic classification never overrides manual exclusions
The scope exclusion reason is recorded as “Non-production resource” so it can be distinguished from user-initiated exclusions.

​
Repositories

Repository classification has additional behavior:
  • Compliance status — Non-production repositories are automatically shown as “Compliant” in the repositories table since they are out of scope.
  • Classification test (cm-001) — A repository passes the “Code repo should be classified” test if it has classified = true (topics or description set) OR environment is set to any value.
  • Default branch — When editing classification, you can also set the default branch used for branch protection checks during sync.

​
Best Practices

Add an env or environment tag to all cloud resources in your provider (AWS, Azure, GCP). LowerPlane will automatically detect and classify them, saving manual work.
Set the environment for all repositories in the Quick Start or Repositories page. This ensures classification tests pass and compliance scores reflect your actual production footprint.
Filter your asset inventory and repositories by “Not set” classification to find resources that need attention. Unclassified production resources may be missing from your compliance scope.
Development tools, CI/CD runners, and internal staging environments should be classified as non-production to keep your compliance scores focused on what matters.