Why classification comes before access control
Access control policy answers who may reach a given piece of data. That question is unanswerable sensibly without first deciding how sensitive the data actually is — public, internal, confidential, restricted to a narrow need-to-know set. Skipping this step tends to produce one of two outcomes: sensitive data protected no better than public information, or ordinary internal data locked down so tightly that legitimate work is constantly blocked.
Classification does not need to be elaborate to be useful. A small number of clearly defined tiers, consistently applied, does more good than an elaborate scheme nobody actually follows in practice.
Classification has to travel with the data
A classification that lives only in a policy document, disconnected from the data itself, tends to get lost the moment the data is copied, exported, or moved into a new system that has no way of knowing it was ever labeled anything. Classification that is durably attached to the data — through metadata, tagging, or the storage system's own access model — survives the ordinary lifecycle of copying and moving that data inevitably goes through.