In my experience doing security embargos/disclosures, it's a lot easier to just explicitly enumerate the set of people/organizational entities who should be given access to non-public information.

Its NOT about controlling traffic lights. Some are networked ("synchronized") so it might be interesting to read about how that's done. https://en.wikipedia.org/wiki/Traffic_light_control_and_coor...

I couldn't help but find that pointless. The conference is open to the public, the only barrier to entry being a small amount of money to purchase a ticket. How would that prevent bad actors from signing up to access the sensitive information?

It absolutely makes sense when used within an organization where access/membership is properly vetted, but there, I feel like there was no point.

   Ultimate  - black/white - passwords/keys/finance/backups
   Private   - red         - hidden by default
   Protected - yellow      - default "logged in to computer"
   Public    - green       - shared w/ others (individuals)
   Broadcast - blue        - intentionally wide distribution

If I post my headshot to hire-an-actor.com, that's "Blue/Broadcast". If I share a picture of my kid blowing out birthday candles, that's "Green/Public". From "Green" you might be able to see the LABELS of my "Yellow" stuff and request access to it, but there should be no indication that "Red" or "Black" even exists.

So basically you as a user always operate at "Yellow", and can push "up" to Green (aka: discord), or Blue (aka: tweeter), and can unlock "Red" or "Black" via Password or 2FA/Cert.

I wish there were a way to easily "vivify" this, but at least putting names to it exposes where/how we're currently lacking.

The biggest issue still remains that content is "slippery" ... if it's not 10000% protected and airgapped, there's a chance that it can "escape".