Macro declassify 

macro_rules! declassify {
    (
        $(#[$meta:meta])*
        $vis:vis $name:ident : $field:ty => $sink:ident,
        purpose = $purpose:literal,
        reason = $reason:literal $(,)?
    ) => { ... };
}

Declare a declassification boundary and register it in the data-flow manifest.

autumn_web::declassify! {
    /// Support agents need the customer's email address to answer the ticket.
    pub SUPPORT_LOOKUP: CustomerEmailClassified => JsonResponse,
    purpose = "support_lookup",
    reason = "Support agents need the email address to answer the ticket.",
}

The field marker (CustomerEmailClassified) is generated by #[model] for the #[classified] column. The sink name is a Sink variant. Both the purpose and the reason are string literals so the manifest can carry them without running the app.