Option A establishes consistent detection semantics before administrators tune individual enforcement actions. Reusing centrally defined DLP engines and classification labels means that the regulated data type is identified consistently across supported web, SaaS, endpoint, and private-application channels. Explicit precedence then prevents conflicting rules from producing intermittent results. Zscaler describes centralized DLP policy across web, SaaS, public cloud, private applications, endpoints, and BYOD. Its MIP-label documentation explains how Microsoft Information Protection labels can be incorporated into custom DLP dictionaries and engines. Creating bespoke channel definitions increases classification drift and investigation effort. Reducing private-application detection deliberately creates a coverage gap. Departmental fragmentation may be appropriate for different business requirements, but it does not solve inconsistent classification of the same regulated data or establish deterministic handling across channels.

================