PMDF System Manager's Guide

The sensitivitynormal, sensitivitypersonal, sensitivityprivate, and sensitivitycompanyconfidential keywords set an upper limit on the sensitivity of messages that may be accepted by a channel. The default is sensitivitycompanyconfidential; i.e., messages of any sensitivity are allowed through. A message with no Sensitivity: header is considered to be of normal, i.e., lowest, sensitivity. Messages with a higher sensitivity than that specified by such a keyword will be rejected when enqueued to the channel with an error:

message too sensitive for one or more paths used

Note that PMDF does this sort of sensitivity checking at a per-message, not per-recipient, level: if a destination channel for one recipient fails the sensitivity check, then the message bounces for all recipients, not just for those recipients associated with the sensitive channel.