diff --git a/opencti-platform/opencti-front/src/private/components/common/containers/ContainerStixCoreObjectPopover.jsx b/opencti-platform/opencti-front/src/private/components/common/containers/ContainerStixCoreObjectPopover.jsx
index 8deade30e10e..727f7a06226a 100644
--- a/opencti-platform/opencti-front/src/private/components/common/containers/ContainerStixCoreObjectPopover.jsx
+++ b/opencti-platform/opencti-front/src/private/components/common/containers/ContainerStixCoreObjectPopover.jsx
@@ -224,7 +224,6 @@ class ContainerStixCoreObjectPopover extends Component {
         }
       },
       onCompleted: () => {
-        this.submitDeleteMapping();
         this.handleCloseDelete();
         const newSelectedElements = R.omit([toId], selectedElements);
         setSelectedElements?.(newSelectedElements);
diff --git a/opencti-platform/opencti-front/src/private/components/common/files/workbench/WorkbenchFileContent.jsx b/opencti-platform/opencti-front/src/private/components/common/files/workbench/WorkbenchFileContent.jsx
index ac2256aeaa3b..be0e35916cbe 100644
--- a/opencti-platform/opencti-front/src/private/components/common/files/workbench/WorkbenchFileContent.jsx
+++ b/opencti-platform/opencti-front/src/private/components/common/files/workbench/WorkbenchFileContent.jsx
@@ -38,7 +38,7 @@ import StixItemLabels from '../../../../../components/StixItemLabels';
 import StixItemMarkings from '../../../../../components/StixItemMarkings';
 import SwitchField from '../../../../../components/SwitchField';
 import TextField from '../../../../../components/TextField';
-import { APP_BASE_PATH, commitMutation, MESSAGING$, QueryRenderer } from '../../../../../relay/environment';
+import { APP_BASE_PATH, commitMutation, handleError, MESSAGING$, QueryRenderer } from '../../../../../relay/environment';
 import { observableValue, resolveIdentityClass, resolveIdentityType, resolveLink, resolveLocationType, resolveThreatActorType } from '../../../../../utils/Entity';
 import { defaultKey, defaultValue } from '../../../../../utils/Graph';
 import useAttributes from '../../../../../utils/hooks/useAttributes';
@@ -807,6 +807,12 @@ const WorkbenchFileContentComponent = ({
                 history.push('/dashboard/data/import');
               }
             },
+            onError: (error) => {
+              handleError(error);
+              setSubmitting(false);
+              resetForm();
+              setDisplayValidate(false);
+            },
           });
         }, 2000);
       },
diff --git a/opencti-platform/opencti-front/src/private/components/data/tasks/TasksList.jsx b/opencti-platform/opencti-front/src/private/components/data/tasks/TasksList.jsx
index bc212f47c8ff..959950de4723 100644
--- a/opencti-platform/opencti-front/src/private/components/data/tasks/TasksList.jsx
+++ b/opencti-platform/opencti-front/src/private/components/data/tasks/TasksList.jsx
@@ -391,8 +391,9 @@ const TasksList = ({ data }) => {
               </Grid>
               <Button
                 style={{ position: 'absolute', right: 10, top: 10 }}
-                variant="contained"
-                color="secondary"
+                variant={task.errors.length > 0 ? 'contained' : 'outlined'}
+                color={'error'}
+                disabled={task.errors.length === 0}
                 onClick={() => handleOpenErrors(task.errors)}
                 size="small"
               >
diff --git a/opencti-platform/opencti-front/src/relay/environment.jsx b/opencti-platform/opencti-front/src/relay/environment.jsx
index 81ec201303eb..1b843e5e3b95 100644
--- a/opencti-platform/opencti-front/src/relay/environment.jsx
+++ b/opencti-platform/opencti-front/src/relay/environment.jsx
@@ -5,7 +5,6 @@ import { debounce } from 'rxjs/operators';
 import React, { Component } from 'react';
 import { commitLocalUpdate as CLU, commitMutation as CM, QueryRenderer as QR, requestSubscription as RS, fetchQuery as FQ } from 'react-relay';
 import * as PropTypes from 'prop-types';
-import { map, isEmpty, filter, pathOr, isNil } from 'ramda';
 import { urlMiddleware, RelayNetworkLayer } from 'react-relay-network-modern';
 import * as R from 'ramda';
 import uploadMiddleware from './uploadMiddleware';
@@ -29,7 +28,7 @@ export class ApplicationError extends Error {
 }
 
 // Network
-const isEmptyPath = isNil(window.BASE_PATH) || isEmpty(window.BASE_PATH);
+const isEmptyPath = R.isNil(window.BASE_PATH) || R.isEmpty(window.BASE_PATH);
 const contextPath = isEmptyPath || window.BASE_PATH === '/' ? '' : window.BASE_PATH;
 export const APP_BASE_PATH = isEmptyPath || contextPath.startsWith('/') ? contextPath : `/${contextPath}`;
 
@@ -89,10 +88,10 @@ QueryRenderer.propTypes = {
   query: PropTypes.object,
 };
 
-const buildErrorMessages = (error) => map(
+const buildErrorMessages = (error) => R.map(
   (e) => ({
     type: 'error',
-    text: pathOr(e.message, ['data', 'reason'], e),
+    text: R.pathOr(e.message, ['data', 'reason'], e),
   }),
   error.res.errors,
 );
@@ -126,11 +125,11 @@ export const commitMutation = ({
   onError: (error) => {
     if (setSubmitting) setSubmitting(false);
     if (error && error.res && error.res.errors) {
-      const authRequired = filter(
-        (e) => pathOr(e.message, ['data', 'type'], e) === 'authentication',
+      const authRequired = R.filter(
+        (e) => R.pathOr(e.message, ['data', 'type'], e) === 'authentication',
         error.res.errors,
       );
-      if (!isEmpty(authRequired)) {
+      if (!R.isEmpty(authRequired)) {
         MESSAGING$.notifyError('Unauthorized action, please refresh your browser');
       } else if (onError) {
         const messages = buildErrorMessages(error);
@@ -157,10 +156,10 @@ export const handleErrorInForm = (error, setErrors) => {
         formattedError.data.message || formattedError.data.reason,
     });
   } else {
-    const messages = map(
+    const messages = R.map(
       (e) => ({
         type: 'error',
-        text: pathOr(e.message, ['data', 'reason'], e),
+        text: R.pathOr(e.message, ['data', 'reason'], e),
       }),
       error.res.errors,
     );
@@ -170,10 +169,10 @@ export const handleErrorInForm = (error, setErrors) => {
 
 export const handleError = (error) => {
   if (error && error.res && error.res.errors) {
-    const messages = map(
+    const messages = R.map(
       (e) => ({
         type: 'error',
-        text: pathOr(e.message, ['data', 'message'], e),
+        text: R.pathOr(e.message, ['data', 'message'], e),
       }),
       error.res.errors,
     );
diff --git a/opencti-platform/opencti-graphql/src/database/file-storage.js b/opencti-platform/opencti-graphql/src/database/file-storage.js
index bd2797440259..bf784625cc5b 100644
--- a/opencti-platform/opencti-graphql/src/database/file-storage.js
+++ b/opencti-platform/opencti-graphql/src/database/file-storage.js
@@ -17,6 +17,7 @@ import { elDeleteFilesByIds } from './file-search';
 import { isAttachmentProcessorEnabled } from './engine';
 import { allFilesForPaths, deleteDocumentIndex, indexFileToDocument } from '../modules/internal/document/document-domain';
 import { truncate } from '../utils/mailData';
+import { controlUserConfidenceAgainstElement } from '../utils/confidence-level';
 
 // Minio configuration
 const clientEndpoint = conf.get('minio:endpoint');
@@ -369,9 +370,20 @@ export const upload = async (context, user, filePath, fileUpload, opts) => {
   };
   // Register in elastic
   await indexFileToDocument(file);
+
+  // confidence control on the context entity (like a report) if we want auto-enrichment
+  let isConfidenceMatch = true;
+  if (entity) {
+    // noThrow ; we do not want to fail here as it's an automatic process.
+    // we will simply not start the job
+    isConfidenceMatch = controlUserConfidenceAgainstElement(user, entity, true);
+  }
+  const isFilePathForImportEnrichment = filePath.startsWith('import/')
+    && !filePath.startsWith('import/pending')
+    && !filePath.startsWith('import/External-Reference');
+
   // Trigger a enrich job for import file if needed
-  if (!noTriggerImport && filePath.startsWith('import/') && !filePath.startsWith('import/pending')
-      && !filePath.startsWith('import/External-Reference')) {
+  if (!noTriggerImport && isConfidenceMatch && isFilePathForImportEnrichment) {
     await uploadJobImport(context, user, file.id, file.metaData.mimetype, file.metaData.entity_id);
   }
   return file;
diff --git a/opencti-platform/opencti-graphql/src/database/middleware.js b/opencti-platform/opencti-graphql/src/database/middleware.js
index b1412ad674bd..1c7e0c80ae95 100644
--- a/opencti-platform/opencti-graphql/src/database/middleware.js
+++ b/opencti-platform/opencti-graphql/src/database/middleware.js
@@ -198,6 +198,12 @@ import { confidence } from '../schema/attribute-definition';
 import { ENTITY_TYPE_INDICATOR } from '../modules/indicator/indicator-types';
 import { FilterMode, FilterOperator } from '../generated/graphql';
 import { getMandatoryAttributesForSetting } from '../modules/entitySetting/entitySetting-attributeUtils';
+import {
+  controlCreateInputWithUserConfidence,
+  controlUserConfidenceAgainstElement,
+  controlUpsertInputWithUserConfidence,
+  adaptUpdateInputsConfidence
+} from '../utils/confidence-level';
 
 // region global variables
 const MAX_BATCH_SIZE = 300;
@@ -1851,7 +1857,7 @@ export const updateAttributeMetaResolved = async (context, user, initial, inputs
         const { value: targetsCreated } = meta[metaIndex];
         const targetCreated = R.head(targetsCreated);
         // If asking for a real change
-        if (currentValue?.standard_id !== targetCreated?.internal_id && currentValue?.id !== targetCreated?.internal_id) {
+        if (currentValue?.id !== targetCreated?.internal_id) {
           // Delete the current relation
           if (currentValue?.standard_id) {
             const currentRels = await listAllRelations(context, user, relType, { fromId: initial.id });
@@ -1982,12 +1988,15 @@ export const updateAttributeFromLoadedWithRefs = async (context, user, initial,
   if (!initial) {
     throw FunctionalError('Cant update undefined element');
   }
-  const updates = Array.isArray(inputs) ? inputs : [inputs];
+  // region confidence control
+  controlUserConfidenceAgainstElement(user, initial);
+  const newInputs = adaptUpdateInputsConfidence(user, inputs, initial);
+  // endregion
   const metaKeys = [...schemaRelationsRefDefinition.getStixNames(initial.entity_type), ...schemaRelationsRefDefinition.getInputNames(initial.entity_type)];
-  const meta = updates.filter((e) => metaKeys.includes(e.key));
+  const meta = newInputs.filter((e) => metaKeys.includes(e.key));
   const metaIds = R.uniq(meta.map((i) => i.value ?? []).flat());
   const metaDependencies = await elFindByIds(context, user, metaIds, { toMap: true, mapWithAllIds: true });
-  const revolvedInputs = updates.map((input) => {
+  const revolvedInputs = newInputs.map((input) => {
     if (metaKeys.includes(input.key)) {
       const resolvedValues = (input.value ?? []).map((refId) => metaDependencies[refId]).filter((o) => isNotEmptyField(o));
       return { ...input, value: resolvedValues };
@@ -2404,8 +2413,13 @@ const upsertElement = async (context, user, element, type, basePatch, opts = {})
     const fileImpact = { key: 'x_opencti_files', value: [...(element.x_opencti_files ?? []), convertedFile] };
     inputs.push(fileImpact);
   }
-  // If confidence is passed at creation, just compare confidence
-  const isConfidenceMatch = (updatePatch.confidence ?? 0) >= (element.confidence ?? 0);
+
+  // region confidence control / upsert
+  const { confidenceLevelToApply, isConfidenceMatch } = controlUpsertInputWithUserConfidence(user, updatePatch, element);
+  updatePatch.confidence = confidenceLevelToApply;
+  // note that if the existing data has no confidence (null) it will still be updated below, even if isConfidenceMatch = false
+  // endregion
+
   // -- Upsert attributes
   const attributes = Array.from(schemaAttributesDefinition.getAttributes(type).values());
   for (let attrIndex = 0; attrIndex < attributes.length; attrIndex += 1) {
@@ -2441,6 +2455,7 @@ const upsertElement = async (context, user, element, type, basePatch, opts = {})
       const isUpsertSynchro = (context.synchronizedUpsert || inputField === INPUT_GRANTED_REFS); // Granted Refs are always fully sync
       if (relDef.multiple) {
         const currentData = element[relDef.databaseName] ?? [];
+        const isCurrentWithData = isNotEmptyField(currentData);
         const targetData = (patchInputData ?? []).map((n) => n.internal_id);
         // If expected data is different from current data
         if (R.symmetricDifference(currentData, targetData).length > 0) {
@@ -2448,17 +2463,26 @@ const upsertElement = async (context, user, element, type, basePatch, opts = {})
           // In full synchro, just replace everything
           if (isUpsertSynchro) {
             inputs.push({ key: inputField, value: patchInputData ?? [], operation: UPDATE_OPERATION_REPLACE });
-          } else if (isInputWithData && diffTargets.length > 0) {
-            // If data is provided and different from existing data, apply an add operation
+          } else if (
+            (isCurrentWithData && isInputWithData && diffTargets.length > 0 && isConfidenceMatch)
+            || (isInputWithData && !isCurrentWithData)
+          ) {
+            // If data is provided, different from existing data, and of higher confidence
+            // OR if existing data is empty and data is provided (even if lower confidence, it's better than nothing),
+            // --> apply an add operation
             inputs.push({ key: inputField, value: diffTargets, operation: UPDATE_OPERATION_ADD });
           }
         }
-      } else {
+      } else { // not multiple
+        // If expected data is different from current data...
         const currentData = element[relDef.databaseName];
-        const updatable = isUpsertSynchro || (isInputWithData && isEmptyField(currentData));
-        // If expected data is different from current data
-        // And data can be updated (complete a null value or forced through synchro upsert option
-        if (!R.equals(currentData, patchInputData) && updatable) {
+        const isInputDifferentFromCurrent = !R.equals(currentData, patchInputData);
+        // ... and data can be updated:
+        //   forced synchro
+        //   OR the field was null -> better than nothing !
+        //   OR the confidence matches -> new value is "better" than existing value
+        const updatable = isUpsertSynchro || (isInputWithData && isEmptyField(currentData)) || isConfidenceMatch;
+        if (isInputDifferentFromCurrent && updatable) {
           inputs.push({ key: inputField, value: [patchInputData] });
         }
       }
@@ -2627,10 +2651,17 @@ export const buildRelationData = async (context, user, input, opts = {}) => {
   };
 };
 
-export const createRelationRaw = async (context, user, input, opts = {}) => {
+export const createRelationRaw = async (context, user, rawInput, opts = {}) => {
   let lock;
   const { fromRule, locks = [] } = opts;
-  const { fromId, toId, relationship_type: relationshipType } = input;
+  const { fromId, toId, relationship_type: relationshipType } = rawInput;
+
+  // region confidence control
+  const input = structuredClone(rawInput);
+  const { confidenceLevelToApply } = controlCreateInputWithUserConfidence(user, input);
+  input.confidence = confidenceLevelToApply; // confidence of the new relation will be capped to user's confidence
+  // endregion
+
   // Pre-check before inputs resolution
   if (fromId === toId) {
     /* v8 ignore next */
@@ -2643,6 +2674,12 @@ export const createRelationRaw = async (context, user, input, opts = {}) => {
   // We need to check existing dependencies
   const resolvedInput = await inputResolveRefs(context, user, filledInput, relationshipType, entitySetting);
   const { from, to } = resolvedInput;
+
+  // when creating stix ref, we must check confidence on from side (this count has modifying this element itself)
+  if (isStixRefRelationship(relationshipType)) {
+    controlUserConfidenceAgainstElement(user, from);
+  }
+
   // check if user has "edit" access on from and to
   if (!validateUserAccessOperation(user, from, 'edit') || !validateUserAccessOperation(user, to, 'edit')) {
     throw ForbiddenAccess();
@@ -2742,10 +2779,8 @@ export const createRelationRaw = async (context, user, input, opts = {}) => {
         });
       }
       // TODO Handling merging relation when updating to prevent multiple relations finding
-      existingRelationship = R.head(filteredRelations);
-      // We can use the resolved input from/to to complete the element
-      existingRelationship.from = from;
-      existingRelationship.to = to;
+      // resolve all refs so we can upsert properly
+      existingRelationship = await storeLoadByIdWithRefs(context, user, R.head(filteredRelations).internal_id);
     }
     // endregion
     if (existingRelationship) {
@@ -3003,12 +3038,17 @@ const buildEntityData = async (context, user, input, type, opts = {}) => {
   };
 };
 
-const createEntityRaw = async (context, user, input, type, opts = {}) => {
-  // Region - Pre-Check
+const createEntityRaw = async (context, user, rawInput, type, opts = {}) => {
+  // region confidence control
+  const input = structuredClone(rawInput);
+  const { confidenceLevelToApply } = controlCreateInputWithUserConfidence(user, input);
+  input.confidence = confidenceLevelToApply; // confidence of new entity will be capped to user's confidence
+  // endregion
+  // region - Pre-Check
   const entitySetting = await getEntitySettingFromCache(context, type);
   const filledInput = fillDefaultValues(user, input, entitySetting);
   await validateEntityAndRelationCreation(context, user, filledInput, type, entitySetting, opts);
-  // Endregion
+  // endregion
   const { fromRule } = opts;
   // We need to check existing dependencies
   const resolvedInput = await inputResolveRefs(context, user, filledInput, type, entitySetting);
@@ -3168,6 +3208,13 @@ export const internalDeleteElementById = async (context, user, id, opts = {}) =>
   if (!element) {
     throw AlreadyDeletedError({ id });
   }
+  // region confidence control
+  controlUserConfidenceAgainstElement(user, element);
+  // when deleting stix ref, we must check confidence on from side (this count has modifying this element itself)
+  if (isStixRefRelationship(element.entity_type)) {
+    controlUserConfidenceAgainstElement(user, element.from);
+  }
+  // endregion
   // Prevent individual deletion if linked to a user
   if (element.entity_type === ENTITY_TYPE_IDENTITY_INDIVIDUAL && !isEmptyField(element.contact_information)) {
     const args = {
diff --git a/opencti-platform/opencti-graphql/src/domain/backgroundTask.js b/opencti-platform/opencti-graphql/src/domain/backgroundTask.js
index 07c1c04d2954..1fb4c2e2e2bd 100644
--- a/opencti-platform/opencti-graphql/src/domain/backgroundTask.js
+++ b/opencti-platform/opencti-graphql/src/domain/backgroundTask.js
@@ -13,6 +13,7 @@ import { ENTITY_TYPE_VOCABULARY } from '../modules/vocabulary/vocabulary-types';
 import { ENTITY_TYPE_NOTIFICATION } from '../modules/notification/notification-types';
 import { ENTITY_TYPE_CASE_TEMPLATE } from '../modules/case/case-template/case-template-types';
 import { ENTITY_TYPE_LABEL } from '../schema/stixMetaObject';
+import { adaptFiltersWithUserConfidence } from '../utils/confidence-level';
 
 export const DEFAULT_ALLOWED_TASK_ENTITY_TYPES = [
   ABSTRACT_STIX_CORE_OBJECT,
@@ -44,7 +45,9 @@ export const findAll = (context, user, args) => {
   return listEntities(context, user, [ENTITY_TYPE_BACKGROUND_TASK], args);
 };
 
-const buildQueryFilters = async (rawFilters, search, taskPosition) => {
+const buildQueryFilters = async (user, filters, search, taskPosition) => {
+  const inputFilters = filters ? JSON.parse(filters) : undefined;
+  const finalFilters = adaptFiltersWithUserConfidence(user, inputFilters);
   // Construct filters
   return {
     types: DEFAULT_ALLOWED_TASK_ENTITY_TYPES,
@@ -52,12 +55,12 @@ const buildQueryFilters = async (rawFilters, search, taskPosition) => {
     orderMode: 'asc',
     orderBy: 'created_at',
     after: taskPosition,
-    filters: rawFilters ? JSON.parse(rawFilters) : undefined,
+    filters: finalFilters,
     search: search && search.length > 0 ? search : null,
   };
 };
 export const executeTaskQuery = async (context, user, filters, search, start = null) => {
-  const options = await buildQueryFilters(filters, search, start);
+  const options = await buildQueryFilters(user, filters, search, start);
   return elPaginate(context, user, READ_DATA_INDICES_WITHOUT_INFERRED, options);
 };
 
diff --git a/opencti-platform/opencti-graphql/src/domain/file.js b/opencti-platform/opencti-graphql/src/domain/file.js
index 9999c369cacc..ba9850db3449 100644
--- a/opencti-platform/opencti-graphql/src/domain/file.js
+++ b/opencti-platform/opencti-graphql/src/domain/file.js
@@ -12,6 +12,7 @@ import { supportedMimeTypes } from '../modules/managerConfiguration/managerConfi
 import { SYSTEM_USER } from '../utils/access';
 import { isEmptyField, isNotEmptyField, READ_INDEX_FILES } from '../database/utils';
 import { getStats } from '../database/engine';
+import { controlUserConfidenceAgainstElement } from '../utils/confidence-level';
 
 export const buildOptionsFromFileManager = async (context) => {
   let importPaths = ['import/'];
@@ -71,6 +72,12 @@ export const askJobImport = async (context, user, args) => {
   const entityId = bypassEntityId || file.metaData.entity_id;
   const opts = { manual: true, connectorId, configuration, bypassValidation };
   const entity = await internalLoadById(context, user, entityId);
+
+  // This is a manual request for import, we have to check confidence and throw on error
+  if (entity) {
+    controlUserConfidenceAgainstElement(user, entity);
+  }
+
   const connectors = await uploadJobImport(context, user, file.id, file.metaData.mimetype, entityId, opts);
   const entityName = entityId ? extractEntityRepresentativeName(entity) : 'global';
   const entityType = entityId ? entity.entity_type : 'global';
diff --git a/opencti-platform/opencti-graphql/src/domain/group.js b/opencti-platform/opencti-graphql/src/domain/group.js
index a76105151ff0..5d3f17d97a60 100644
--- a/opencti-platform/opencti-graphql/src/domain/group.js
+++ b/opencti-platform/opencti-graphql/src/domain/group.js
@@ -129,6 +129,10 @@ export const groupEditField = async (context, user, groupId, input) => {
     message: `updates \`${input.map((i) => i.key).join(', ')}\` for group \`${element.name}\``,
     context_data: { id: groupId, entity_type: ENTITY_TYPE_GROUP, input }
   });
+  // on editing the group confidence level, all memebers might have changed their effective level
+  if (input.find((i) => i.key === 'group_confidence_level')) {
+    await groupSessionRefresh(context, user, groupId);
+  }
   return notify(BUS_TOPICS[ENTITY_TYPE_GROUP].EDIT_TOPIC, element, user);
 };
 
diff --git a/opencti-platform/opencti-graphql/src/domain/user.js b/opencti-platform/opencti-graphql/src/domain/user.js
index 22db89f0ba8a..10b6def294be 100644
--- a/opencti-platform/opencti-graphql/src/domain/user.js
+++ b/opencti-platform/opencti-graphql/src/domain/user.js
@@ -658,6 +658,10 @@ export const userEditField = async (context, user, userId, rawInputs) => {
       inputs.push({ key: 'account_status', value: [ACCOUNT_STATUS_EXPIRED] });
       await killUserSessions(userId);
     }
+    if (input.key === 'user_confidence_level') {
+      // user's effective level might have changed, we need to refresh session info
+      await userSessionRefresh(userId);
+    }
     inputs.push(input);
   }
   const { element } = await updateAttribute(context, user, userId, ENTITY_TYPE_USER, inputs);
@@ -1180,6 +1184,7 @@ const buildSessionUser = (origin, impersonate, provider, settings) => {
       definition_type: m.definition_type,
     })),
     session_version: PLATFORM_VERSION,
+    effective_confidence_level: user.effective_confidence_level,
     ...user.provider_metadata
   };
 };
@@ -1445,6 +1450,10 @@ export const initAdmin = async (context, email, password, tokenValue) => {
       description: 'Principal admin account',
       api_token: tokenValue,
       password,
+      user_confidence_level: {
+        max_confidence: 100,
+        overrides: [],
+      },
     };
     await addUser(context, SYSTEM_USER, userToCreate);
     await userSessionRefresh(OPENCTI_ADMIN_UUID);
@@ -1474,5 +1483,8 @@ export const userEditContext = async (context, user, userId, input) => {
 
 export const getUserEffectiveConfidenceLevel = async (userId, context) => {
   const user = await findById(context, context.user, userId); // this returns a complete user, with groups
+  if (!user) {
+    throw FunctionalError('User not found', { user_id: userId });
+  }
   return computeUserEffectiveConfidenceLevel(user);
 };
diff --git a/opencti-platform/opencti-graphql/src/manager/taskManager.js b/opencti-platform/opencti-graphql/src/manager/taskManager.js
index a3986692bdbf..1614139ea1ac 100644
--- a/opencti-platform/opencti-graphql/src/manager/taskManager.js
+++ b/opencti-platform/opencti-graphql/src/manager/taskManager.js
@@ -57,6 +57,7 @@ import { promoteIndicatorToObservable } from '../modules/indicator/indicator-dom
 import { askElementEnrichmentForConnector } from '../domain/stixCoreObject';
 import { RELATION_GRANTED_TO, RELATION_OBJECT } from '../schema/stixRefRelationship';
 import { ACTION_TYPE_DELETE, ACTION_TYPE_SHARE, ACTION_TYPE_UNSHARE, TASK_TYPE_LIST, TASK_TYPE_QUERY, TASK_TYPE_RULE } from '../domain/backgroundTask-common';
+import { controlUserConfidenceAgainstElement } from '../utils/confidence-level';
 
 // Task manager responsible to execute long manual tasks
 // Each API will start is task manager.
@@ -136,6 +137,7 @@ const computeQueryTaskElements = async (context, user, task) => {
   const { actions, task_position, task_filters, task_search = null, task_excluded_ids = [] } = task;
   const processingElements = [];
   // Fetch the information
+  // note that the query is filtered to allow only elements with matching confidence level
   const data = await executeTaskQuery(context, user, task_filters, task_search, task_position);
   // const expectedNumber = data.pageInfo.globalCount;
   const elements = data.edges;
@@ -159,7 +161,11 @@ const computeListTaskElements = async (context, user, task) => {
     const elementToResolve = ids[indexId];
     const element = await internalLoadById(context, user, elementToResolve, { type: DEFAULT_ALLOWED_TASK_ENTITY_TYPES });
     if (element) {
-      processingElements.push({ element, next: element.id });
+      // only process elements allowed by confidence control (no throw)
+      const isConfidenceMatch = controlUserConfidenceAgainstElement(user, element, true);
+      if (isConfidenceMatch) {
+        processingElements.push({ element, next: element.id });
+      }
     }
   }
   return { actions, elements: processingElements };
@@ -421,7 +427,7 @@ const executeProcessing = async (context, user, job) => {
             await executeUnshare(context, user, actionContext, element);
           }
         } catch (err) {
-          errors.push({ id: element.id, message: `${err.message} - ${err.data?.reason ?? err.reason}` });
+          errors.push({ id: element.id, message: `${err.message} - ${err.data?.reason ?? err.reason ?? 'no reason provided'}` });
         }
       }
     }
diff --git a/opencti-platform/opencti-graphql/src/utils/confidence-level.ts b/opencti-platform/opencti-graphql/src/utils/confidence-level.ts
index fd068e226006..bbab16f0be78 100644
--- a/opencti-platform/opencti-graphql/src/utils/confidence-level.ts
+++ b/opencti-platform/opencti-graphql/src/utils/confidence-level.ts
@@ -1,5 +1,17 @@
 import type { AuthUser } from '../types/user';
 import { cropNumber } from './math';
+import { isEmptyField } from '../database/utils';
+import { FunctionalError, LockTimeoutError } from '../config/errors';
+import { logApp } from '../config/conf';
+import { schemaAttributesDefinition } from '../schema/schema-attributes';
+import { type Filter, type FilterGroup, FilterMode, FilterOperator } from '../generated/graphql';
+import { isFilterGroupNotEmpty } from './filtering/filtering-utils';
+
+type ObjectWithConfidence = {
+  id: string,
+  entity_type: string,
+  confidence?: number | null
+};
 
 export const computeUserEffectiveConfidenceLevel = (user: AuthUser) => {
   // if user has a specific confidence level, it overrides everything and we return it
@@ -42,3 +54,168 @@ export const computeUserEffectiveConfidenceLevel = (user: AuthUser) => {
   // finally, if this user has no effective confidence level, we can return null
   return null;
 };
+
+const capInputConfidenceWithUserMaxConfidence = (userMaxConfidence: number, inputConfidence?: number | null) => {
+  const input = cropNumber(inputConfidence ?? 100, 0, 100); // input always untrusted, crop in 0-100
+  return Math.min(userMaxConfidence, input); // will always equal userMaxConfidence if no inputConfidence
+};
+
+/**
+ * Assert the confidence control on an input object from create operations
+ * Returns the confidence to apply on the resulting element.
+ */
+export const controlCreateInputWithUserConfidence = <T extends ObjectWithConfidence>(user: AuthUser, inputElement: T) => {
+  if (isEmptyField(user.effective_confidence_level?.max_confidence)) {
+    // using LockTimeoutError allows us to leverage the worker infinite auto-retry, so that connectors and feeds won't lose messages
+    // this is a configuration error that might appear when upgrading to 6.X, but shall disappear in future when everyone has confidence level set up.
+    throw LockTimeoutError({ user_id: user.id }, 'User has no effective max confidence level and cannot create this element');
+  }
+  const userMaxConfidence = user.effective_confidence_level?.max_confidence as number;
+  const inputConfidence = inputElement.confidence;
+  const confidenceLevelToApply = capInputConfidenceWithUserMaxConfidence(userMaxConfidence, inputConfidence);
+  return {
+    confidenceLevelToApply,
+  };
+};
+
+/**
+ * Assert the confidence control on an input object during upsert operation.
+ * Returns a flag to know if the confidences match properly, plus the confidence to apply on the resulting element.
+ */
+export const controlUpsertInputWithUserConfidence = <T extends ObjectWithConfidence>(user: AuthUser, inputElementOrPatch: T, existingElement: T) => {
+  if (isEmptyField(user.effective_confidence_level?.max_confidence)) {
+    throw LockTimeoutError({ user_id: user.id, element_id: existingElement.id }, 'User has no effective max confidence level and cannot upsert this element');
+  }
+  const userMaxConfidence = user.effective_confidence_level?.max_confidence as number;
+  const confidenceLevelToApply = capInputConfidenceWithUserMaxConfidence(userMaxConfidence, inputElementOrPatch.confidence);
+  const existing = cropNumber(existingElement.confidence ?? 0, 0, 100);
+  const isConfidenceMatch = confidenceLevelToApply >= existing; // always true if no existingConfidence
+
+  return {
+    confidenceLevelToApply,
+    isConfidenceMatch,
+  };
+};
+
+/**
+ * Assert the confidence control for a given user over a given object in the platform.
+ * Throw errors by default, use the flag noThrow to return a boolean instead (false in case of error).
+ */
+export const controlUserConfidenceAgainstElement = <T extends ObjectWithConfidence>(user: AuthUser, existingElement: T, noThrow = false) => {
+  const hasConfidenceAttribute = schemaAttributesDefinition.getAttribute(existingElement.entity_type, 'confidence');
+  if (!hasConfidenceAttribute) {
+    return true; // no confidence to check, it's ok
+  }
+
+  if (isEmptyField(user.effective_confidence_level?.max_confidence)) {
+    if (noThrow) {
+      return false;
+    }
+    throw LockTimeoutError({ user_id: user.id, element_id: existingElement.id }, 'User has no effective max confidence level and cannot update this element');
+  }
+
+  const userMaxConfidence = user.effective_confidence_level?.max_confidence as number;
+  const existing = cropNumber(existingElement.confidence ?? 0, 0, 100);
+  const isConfidenceMatch = userMaxConfidence >= existing; // always true if no existingConfidence
+
+  // contrary to upsert (where we might still update fields that were empty even if confidence control is negative)
+  // a user cannot update an object without the right confidence
+  if (!isConfidenceMatch) {
+    if (noThrow) {
+      return false;
+    }
+    throw FunctionalError('User effective max confidence level is insufficient to update this element', { user_id: user.id, element_id: existingElement.id });
+  }
+
+  return true; // ok
+};
+
+type UpdateInput = {
+  key: string | string[]
+  value: string[]
+};
+
+/**
+ * Adapt the input data during an update operation, according to confidence control.
+ *   1) If input contains a new confidence level, it is capped by user's level,
+ *   2) if the element has no confidence, we make sure it has one after update (fallback to user's level)
+ */
+export const adaptUpdateInputsConfidence = <T extends ObjectWithConfidence>(user: AuthUser, inputs: UpdateInput | UpdateInput[], element: T) => {
+  if (isEmptyField(user.effective_confidence_level?.max_confidence)) {
+    throw LockTimeoutError({ user_id: user.id, element_id: element.id }, 'User has no effective max confidence level and cannot update this element');
+  }
+  const inputsArray = Array.isArray(inputs) ? inputs : [inputs];
+  const userMaxConfidenceLevel = user.effective_confidence_level?.max_confidence as number;
+  let hasConfidenceInput = false;
+
+  // cap confidence change with user's confidence
+  const newInputs = inputsArray.map((input) => {
+    const keysArray = Array.isArray(input.key) ? input.key : [input.key];
+    if (keysArray.includes('confidence')) {
+      const newValue = parseInt(input.value[0], 10);
+      if (userMaxConfidenceLevel < newValue) {
+        logApp.warn('Object confidence cannot be updated above user\'s max confidence level, the value has been capped.', { user_id: user.id, element_id: element.id });
+      }
+      hasConfidenceInput = true;
+      return {
+        ...input,
+        value: [Math.min(userMaxConfidenceLevel, newValue).toString()]
+      };
+    }
+    return input;
+  });
+
+  // if the initial element does not have any confidence prior to this update, and we are not setting one now
+  // then we force the element confidence to the user's confidence
+  const hasConfidenceAttribute = schemaAttributesDefinition.getAttribute(element.entity_type, 'confidence');
+  if (hasConfidenceAttribute && isEmptyField(element.confidence) && inputsArray.length > 0 && !hasConfidenceInput) {
+    newInputs.push({ key: 'confidence', value: [userMaxConfidenceLevel.toString()] });
+  }
+
+  return newInputs;
+};
+
+/**
+ * Narrow the input filter with a AND on the user's max confidence.
+ * Result filter will filter out any element without the required confidence (+ input filter).
+ */
+export const adaptFiltersWithUserConfidence = (user: AuthUser, filters: FilterGroup): FilterGroup => {
+  if (isEmptyField(user.effective_confidence_level?.max_confidence)) {
+    throw LockTimeoutError({ user_id: user.id }, 'User has no effective max confidence level and cannot run this filter');
+  }
+  const userMaxConfidenceLevel = user.effective_confidence_level?.max_confidence as number;
+
+  // we will filter to get only elements that have...
+  // ... no confidence attribute (no control to do)
+  const entitiesWithoutConfidence: Filter = {
+    key: [
+      'entity_type'
+    ],
+    operator: FilterOperator.NotEq,
+    values: ['Stix-Domain-Object', 'Stix-Relationship'] // only types with confidence judging from schema
+  };
+  // ... a confidence level lower or equal to the user's level
+  const userConfidenceFilter: Filter = {
+    key: ['confidence'],
+    operator: FilterOperator.Lte,
+    values: [userMaxConfidenceLevel]
+  };
+  // ... or no confidence level at all (might happen when inserting data with the API with version <6.0, we consider zero)
+  const nilConfidenceFilter: Filter = {
+    key: ['confidence'],
+    operator: FilterOperator.Nil,
+    values: [],
+  };
+  const orFilterGroup: FilterGroup = {
+    mode: FilterMode.Or,
+    filters: [entitiesWithoutConfidence, userConfidenceFilter, nilConfidenceFilter,],
+    filterGroups: [],
+  };
+
+  // nest: this filter AND the input filters
+  return {
+    mode: FilterMode.And,
+    filters: [],
+    filterGroups: isFilterGroupNotEmpty(filters) ? [orFilterGroup, filters] : [orFilterGroup],
+  };
+};
diff --git a/opencti-platform/opencti-graphql/tests/01-unit/utils/confidence-level-test.ts b/opencti-platform/opencti-graphql/tests/01-unit/utils/confidence-level-test.ts
index 678a3c7413f1..37c3b1cfe1e5 100644
--- a/opencti-platform/opencti-graphql/tests/01-unit/utils/confidence-level-test.ts
+++ b/opencti-platform/opencti-graphql/tests/01-unit/utils/confidence-level-test.ts
@@ -1,29 +1,36 @@
 import { describe, expect, it } from 'vitest';
-import { computeUserEffectiveConfidenceLevel } from '../../../src/utils/confidence-level';
+import {
+  adaptFiltersWithUserConfidence,
+  adaptUpdateInputsConfidence,
+  computeUserEffectiveConfidenceLevel,
+  controlCreateInputWithUserConfidence,
+  controlUpsertInputWithUserConfidence,
+  controlUserConfidenceAgainstElement
+} from '../../../src/utils/confidence-level';
 import type { AuthUser } from '../../../src/types/user';
+import { type FilterGroup, FilterMode, FilterOperator } from '../../../src/generated/graphql';
 
-describe('Confidence level utilities', () => {
-  it('computeUserEffectiveConfidenceLevel should correctly compute the effective level', async () => {
-    const group70 = {
-      id: 'group70',
-      group_confidence_level: {
-        max_confidence: 70,
-        overrides: [],
-      }
-    };
+const makeUser = (confidence: number | null) => ({
+  id: `user_${confidence}`,
+  effective_confidence_level: confidence ? { max_confidence: confidence } : null
+} as AuthUser);
 
-    const group80 = {
-      id: 'group80',
-      group_confidence_level: {
-        max_confidence: 70,
-        overrides: [],
-      }
-    };
+const makeGroup = (confidence: number | null) => ({
+  id: `group_${confidence}`,
+  group_confidence_level: confidence ? { max_confidence: confidence, overrides: [] } : null
+});
 
-    const groupNull = {
-      id: 'groupNull',
-      group_confidence_level: null
-    };
+const makeElement = (confidence?: number | null) => ({
+  id: `object_${confidence}`,
+  entity_type: 'Report',
+  confidence,
+});
+
+describe('Confidence level utilities', () => {
+  it('computeUserEffectiveConfidenceLevel should correctly compute the effective level', async () => {
+    const group70 = makeGroup(70);
+    const group80 = makeGroup(80);
+    const groupNull = makeGroup(null);
 
     // minimal subset of a real User
     const userA = {
@@ -73,4 +80,185 @@ describe('Confidence level utilities', () => {
     };
     expect(computeUserEffectiveConfidenceLevel(userE as unknown as AuthUser)).toBeNull();
   });
+
+  describe('Control confidence', () => {
+    it('on any element', () => {
+      expect(() => controlUserConfidenceAgainstElement(makeUser(50), makeElement(30)))
+        .not.toThrowError();
+      expect(() => controlUserConfidenceAgainstElement(makeUser(30), makeElement(50)))
+        .toThrowError('User effective max confidence level is insufficient to update this element');
+      expect(() => controlUserConfidenceAgainstElement(makeUser(50), makeElement(null)))
+        .not.toThrowError();
+      expect(() => controlUserConfidenceAgainstElement(makeUser(null), makeElement(30)))
+        .toThrowError('User has no effective max confidence level and cannot update this element');
+      expect(() => controlUserConfidenceAgainstElement(makeUser(50), {
+        id: 'object_no_confidence',
+        entity_type: 'Artifact',
+      })).not.toThrowError();
+      expect(() => controlUserConfidenceAgainstElement(makeUser(null), {
+        id: 'object_no_confidence',
+        entity_type: 'Artifact',
+      })).not.toThrowError(); // existence of user level is not even checked
+    });
+    it('on any element (noThrow)', () => {
+      expect(controlUserConfidenceAgainstElement(makeUser(50), makeElement(30), true)).toEqual(true);
+      expect(controlUserConfidenceAgainstElement(makeUser(30), makeElement(50), true)).toEqual(false);
+      expect(controlUserConfidenceAgainstElement(makeUser(50), makeElement(null), true)).toEqual(true);
+      expect(controlUserConfidenceAgainstElement(makeUser(null), makeElement(30), true)).toEqual(false);
+      expect(controlUserConfidenceAgainstElement(makeUser(50), { id: 'object_no_confidence', entity_type: 'Artifact' }, true)).toEqual(true);
+      expect(controlUserConfidenceAgainstElement(makeUser(null), { id: 'object_no_confidence', entity_type: 'Artifact' }, true)).toEqual(true);
+    });
+    it('on create input', () => {
+      expect(controlCreateInputWithUserConfidence(makeUser(50), makeElement(30))).toEqual({
+        confidenceLevelToApply: 30,
+      });
+      expect(controlCreateInputWithUserConfidence(makeUser(30), makeElement(50))).toEqual({
+        confidenceLevelToApply: 30,
+      });
+      expect(controlCreateInputWithUserConfidence(makeUser(30), makeElement(null))).toEqual({
+        confidenceLevelToApply: 30,
+      });
+      expect(() => controlCreateInputWithUserConfidence(makeUser(null), makeElement(50)))
+        .toThrowError('User has no effective max confidence level and cannot create this element');
+    });
+    it('on upsert input', () => {
+      expect(controlUpsertInputWithUserConfidence(makeUser(50), makeElement(30), makeElement(10)))
+        .toEqual({
+          isConfidenceMatch: true,
+          confidenceLevelToApply: 30,
+        });
+      expect(controlUpsertInputWithUserConfidence(makeUser(50), makeElement(10), makeElement(30)))
+        .toEqual({
+          isConfidenceMatch: false,
+          confidenceLevelToApply: 10,
+        });
+      expect(controlUpsertInputWithUserConfidence(makeUser(30), makeElement(50), makeElement(10)))
+        .toEqual({
+          isConfidenceMatch: true,
+          confidenceLevelToApply: 30,
+        });
+      expect(controlUpsertInputWithUserConfidence(makeUser(30), makeElement(10), makeElement(50)))
+        .toEqual({
+          isConfidenceMatch: false,
+          confidenceLevelToApply: 10,
+        });
+      expect(controlUpsertInputWithUserConfidence(makeUser(10), makeElement(50), makeElement(30)))
+        .toEqual({
+          isConfidenceMatch: false,
+          confidenceLevelToApply: 10,
+        });
+      expect(controlUpsertInputWithUserConfidence(makeUser(10), makeElement(30), makeElement(50)))
+        .toEqual({
+          isConfidenceMatch: false,
+          confidenceLevelToApply: 10,
+        });
+      expect(controlUpsertInputWithUserConfidence(makeUser(50), makeElement(null), makeElement(30)))
+        .toEqual({
+          isConfidenceMatch: true,
+          confidenceLevelToApply: 50,
+        });
+      expect(controlUpsertInputWithUserConfidence(makeUser(30), makeElement(null), makeElement(50)))
+        .toEqual({
+          isConfidenceMatch: false,
+          confidenceLevelToApply: 30,
+        });
+      expect(controlUpsertInputWithUserConfidence(makeUser(50), makeElement(30), makeElement(null)))
+        .toEqual({
+          isConfidenceMatch: true,
+          confidenceLevelToApply: 30,
+        });
+      expect(controlUpsertInputWithUserConfidence(makeUser(30), makeElement(50), makeElement(null)))
+        .toEqual({
+          isConfidenceMatch: true,
+          confidenceLevelToApply: 30,
+        });
+      expect(controlUpsertInputWithUserConfidence(makeUser(30), makeElement(null), makeElement(null)))
+        .toEqual({
+          isConfidenceMatch: true,
+          confidenceLevelToApply: 30,
+        });
+      expect(() => controlUpsertInputWithUserConfidence(makeUser(null), makeElement(30), makeElement(50)))
+        .toThrowError('User has no effective max confidence level and cannot upsert this element');
+    });
+  });
+
+  it('adaptUpdateInputsConfidence should adapt correctly input payload', () => {
+    const makeConfidenceInput = (confidence: number) => ({
+      key: 'confidence',
+      value: [confidence.toString()],
+    });
+    const otherInput = {
+      key: 'description',
+      value: ['some text'],
+    };
+
+    expect(adaptUpdateInputsConfidence(makeUser(50), makeConfidenceInput(30), makeElement(10)))
+      .toEqual([{ key: 'confidence', value: ['30'] }]);
+    expect(adaptUpdateInputsConfidence(makeUser(50), makeConfidenceInput(10), makeElement(30)))
+      .toEqual([{ key: 'confidence', value: ['10'] }]);
+    expect(adaptUpdateInputsConfidence(makeUser(30), makeConfidenceInput(50), makeElement(10)))
+      .toEqual([{ key: 'confidence', value: ['30'] }]); // capped
+    expect(adaptUpdateInputsConfidence(makeUser(30), makeConfidenceInput(10), makeElement(50)))
+      .toEqual([{ key: 'confidence', value: ['10'] }]); // this function does not control against element!
+    expect(adaptUpdateInputsConfidence(makeUser(10), makeConfidenceInput(50), makeElement(30)))
+      .toEqual([{ key: 'confidence', value: ['10'] }]); // capped / this function does not control against element!
+    expect(adaptUpdateInputsConfidence(makeUser(10), makeConfidenceInput(30), makeElement(50)))
+      .toEqual([{ key: 'confidence', value: ['10'] }]); // capped / this function does not control against element!
+    expect(adaptUpdateInputsConfidence(makeUser(10), otherInput, makeElement(50)))
+      .toEqual([otherInput]); // no need to inject confidence
+    expect(adaptUpdateInputsConfidence(makeUser(10), otherInput, makeElement(null)))
+      .toEqual([otherInput, { key: 'confidence', value: ['10'] }]); // inject user's confidence
+    expect(adaptUpdateInputsConfidence(makeUser(10), makeConfidenceInput(30), makeElement(null)))
+      .toEqual([{ key: 'confidence', value: ['10'] }]); // capped / no need to inject user's confidence
+  });
+
+  it('getConfidenceFilterForUser shall produce correct filters', () => {
+    const emptyFilterGroup: FilterGroup = {
+      mode: FilterMode.And,
+      filterGroups: [],
+      filters: [],
+    };
+    const exampleFilterGroup: FilterGroup = {
+      mode: FilterMode.Or,
+      filterGroups: [],
+      filters: [
+        { key: ['name'], operator: FilterOperator.Contains, mode: FilterMode.Or, values: ['aa', 'bb', 'cc'] },
+        { key: ['score'], operator: FilterOperator.Gte, mode: FilterMode.And, values: [70] }
+      ],
+    };
+    const injectedFilters: FilterGroup = {
+      mode: FilterMode.Or,
+      filterGroups: [],
+      filters: [
+        {
+          key: ['entity_type'],
+          operator: FilterOperator.NotEq,
+          values: ['Stix-Domain-Object', 'Stix-Relationship'],
+        },
+        {
+          key: ['confidence'],
+          operator: FilterOperator.Lte,
+          values: [50],
+        },
+        {
+          key: ['confidence'],
+          operator: FilterOperator.Nil,
+          values: [],
+        },
+      ],
+    };
+
+    expect(adaptFiltersWithUserConfidence(makeUser(50), emptyFilterGroup))
+      .toEqual({
+        mode: FilterMode.And,
+        filters: [],
+        filterGroups: [injectedFilters]
+      });
+    expect(adaptFiltersWithUserConfidence(makeUser(50), exampleFilterGroup))
+      .toEqual({
+        mode: FilterMode.And,
+        filters: [],
+        filterGroups: [injectedFilters, exampleFilterGroup]
+      });
+  });
 });
diff --git a/opencti-platform/opencti-graphql/tests/02-integration/01-database/file-storage-test.js b/opencti-platform/opencti-graphql/tests/02-integration/01-database/file-storage-test.js
index cc5206b85766..f3003f7436ca 100644
--- a/opencti-platform/opencti-graphql/tests/02-integration/01-database/file-storage-test.js
+++ b/opencti-platform/opencti-graphql/tests/02-integration/01-database/file-storage-test.js
@@ -38,7 +38,7 @@ describe('File storage file listing', () => {
     let file = head(list.edges).node;
     expect(file.id).toEqual(exportFileId(malware));
     expect(file.name).toEqual(exportFileName);
-    expect(file.size).toEqual(10692);
+    expect(file.size).toEqual(10700);
     expect(file.metaData).not.toBeNull();
     expect(file.metaData.encoding).toEqual('7bit');
     expect(file.metaData.filename).toEqual(exportFileName.replace(/\s/g, '%20'));
@@ -48,7 +48,7 @@ describe('File storage file listing', () => {
     expect(list.edges.length).toEqual(1);
     file = head(list.edges).node;
     expect(file.id).toEqual(importFileId);
-    expect(file.size).toEqual(10692);
+    expect(file.size).toEqual(10700);
     expect(file.name).toEqual(exportFileName);
   });
   it('should all file listing', async () => {
@@ -68,7 +68,7 @@ describe('File storage file listing', () => {
     files = await allFilesForPaths(testContext, ADMIN_USER, ['export/Malware'], { entity_id: 'unknow_id' });
     expect(files.length).toEqual(0);
     // maxFileSize filtering
-    files = await allFilesForPaths(testContext, ADMIN_USER, ['export/Malware'], { maxFileSize: 10692 });
+    files = await allFilesForPaths(testContext, ADMIN_USER, ['export/Malware'], { maxFileSize: 10700 });
     expect(files.length).toEqual(1);
     files = await allFilesForPaths(testContext, ADMIN_USER, ['export/Malware'], { maxFileSize: 1692 });
     expect(files.length).toEqual(0);
@@ -102,7 +102,7 @@ describe('File storage file listing', () => {
     expect(file).not.toBeNull();
     expect(file.id).toEqual(exportFileId(malware));
     expect(file.name).toEqual(exportFileName);
-    expect(file.size).toEqual(10692);
+    expect(file.size).toEqual(10700);
   });
   it('should delete file', async () => {
     const malware = await elLoadById(testContext, ADMIN_USER, 'malware--faa5b705-cf44-4e50-8472-29e5fec43c3c');
diff --git a/opencti-platform/opencti-graphql/tests/02-integration/01-database/middleware-test.js b/opencti-platform/opencti-graphql/tests/02-integration/01-database/middleware-test.js
index e8b99500357a..02ed3512d27c 100644
--- a/opencti-platform/opencti-graphql/tests/02-integration/01-database/middleware-test.js
+++ b/opencti-platform/opencti-graphql/tests/02-integration/01-database/middleware-test.js
@@ -745,6 +745,7 @@ describe('Upsert and merge entities', () => {
       description: 'MALWARE_TEST DESCRIPTION',
       stix_id: 'malware--907bb632-e3c2-52fa-b484-cf166a7d377e',
       objectMarking: [clearMarking, mitreMarking],
+      confidence: 15, // not set, it would fallback to user's confidence which is 100
     };
     const createdMalware = await addMalware(testContext, ADMIN_USER, malware);
     expect(createdMalware).not.toBeNull();
@@ -755,7 +756,11 @@ describe('Upsert and merge entities', () => {
     expect(loadMalware).not.toBeNull();
     expect(loadMalware['object-marking'].length).toEqual(2);
     // Upsert TLP by name
-    let upMalware = { name: 'MALWARE_TEST', objectMarking: [testMarking] };
+    let upMalware = {
+      name: 'MALWARE_TEST',
+      objectMarking: [testMarking],
+      confidence: 15,
+    };
     let upsertedMalware = await addMalware(testContext, ADMIN_USER, upMalware);
     expect(upsertedMalware).not.toBeNull();
     expect(upsertedMalware.id).toEqual(createdMalware.id);
@@ -768,7 +773,7 @@ describe('Upsert and merge entities', () => {
       description: 'MALWARE_TEST NEW',
       stix_id: 'malware--907bb632-e3c2-52fa-b484-cf166a7d377e',
       aliases: ['NEW MALWARE ALIAS'],
-      confidence: 90,
+      confidence: 90, // 90 > 15, so it's upserted
     };
     upsertedMalware = await addMalware(testContext, ADMIN_USER, upMalware);
     expect(upsertedMalware.name).toEqual('NEW NAME');
@@ -1130,6 +1135,7 @@ describe('Elements impacts deletions', () => {
 describe('Elements upsert behaviors', () => {
   it('should upsert empty values', async () => {
     const clearMarking = 'marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9';
+    const greenMarking = 'marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da';
     const stixId = 'malware--78ca4366-f5b8-4764-83f7-34ce38198e28';
 
     // Create entities
@@ -1157,6 +1163,7 @@ describe('Elements upsert behaviors', () => {
     expect(malware.first_seen).toEqual('1970-01-01T00:00:00.000Z');
     expect(malware.malware_types).toEqual(['downloader', 'trojan']);
     expect(malware.objectMarking.length).toEqual(1);
+
     // Test on existing value [same confidence level]
     malware = await addMalware(testContext, ADMIN_USER, { ...base, description: 'TO DESC UPGRADE', first_seen: '2023-09-21T22:04:09.409Z' });
     expect(malware.confidence).toEqual(10);
@@ -1171,6 +1178,43 @@ describe('Elements upsert behaviors', () => {
     expect(malware.confidence).toEqual(11);
     expect(malware.description).toEqual('TO DESC UPPER');
 
+    // on "multiple" attribute
+    // if confidence is lower, data should not be added to the list
+    malware = await addMalware(testContext, ADMIN_USER, {
+      ...base,
+      confidence: 1,
+      malware_types: ['rootkit'],
+    });
+    expect(malware.confidence).toEqual(11);
+    expect(malware.malware_types).toEqual(['downloader', 'trojan']);
+    // if confidence is higher or equal, data should be added to the list
+    malware = await addMalware(testContext, ADMIN_USER, {
+      ...base,
+      confidence: 11,
+      malware_types: ['rootkit'],
+    });
+    expect(malware.confidence).toEqual(11);
+    expect(malware.malware_types).toEqual(['downloader', 'trojan', 'rootkit']);
+
+    // on "multiple" refs
+    // if confidence is lower, data should not be added to the list
+    malware = await addMalware(testContext, ADMIN_USER, {
+      ...base,
+      confidence: 1,
+      objectMarking: [greenMarking],
+    });
+    expect(malware.confidence).toEqual(11);
+    expect(malware.objectMarking[0].standard_id).toEqual(clearMarking);
+    // if confidence is higher or equal, data should be added to the list
+    malware = await addMalware(testContext, ADMIN_USER, {
+      ...base,
+      confidence: 11,
+      objectMarking: [greenMarking],
+    });
+    expect(malware.confidence).toEqual(11);
+    expect(malware.objectMarking[0].standard_id).toEqual(greenMarking);
+    // in case of marking, the highest rank is kept so we'll have only one
+
     // Upsert forcing the synchronization
     const syncContext = { ...testContext, synchronizedUpsert: true };
     malware = await addMalware(syncContext, ADMIN_USER, { ...base, confidence: 1, objectMarking: [], description: 'TO_UPSERT' });
diff --git a/opencti-platform/opencti-graphql/tests/02-integration/01-database/taxii-filtering-test.js b/opencti-platform/opencti-graphql/tests/02-integration/01-database/taxii-filtering-test.js
index ff16fa12821c..e05ff3393f91 100644
--- a/opencti-platform/opencti-graphql/tests/02-integration/01-database/taxii-filtering-test.js
+++ b/opencti-platform/opencti-graphql/tests/02-integration/01-database/taxii-filtering-test.js
@@ -272,7 +272,7 @@ describe('Complex filters combinations, behavior tested on taxii collections', (
       filters: [{
         key: 'confidence',
         values: ['90'],
-        operator: 'gte',
+        operator: 'eq',
       }],
       filterGroups: [{
         mode: 'and',
@@ -368,8 +368,8 @@ describe('Complex filters combinations, behavior tested on taxii collections', (
     taxiiCollection = await storeLoadById(testContext, ADMIN_USER, taxiiInternalId, ENTITY_TYPE_TAXII_COLLECTION);
     const { edges: results6 } = await collectionQuery(testContext, ADMIN_USER, taxiiCollection, {});
     edgeIds = results6.map((e) => e.node.internal_id);
-    expect(edgeIds.length).toEqual(1);
-    expect(edgeIds[0]).toEqual(city3InternalId);
+    expect(edgeIds.length).toEqual(2); // City3 + Heitzing in DATA_STIX2_v2 (no confidence so inserted with user's confidence which is 100)
+    expect(edgeIds[1]).toEqual(city3InternalId);
     // --- 07. filters with keys that require a conversion --- //
     // objectMarking = marking1
     await changeTaxiiFilters({
diff --git a/opencti-platform/opencti-graphql/tests/03-streams/00-Raw/raw-test.js b/opencti-platform/opencti-graphql/tests/03-streams/00-Raw/raw-test.js
index ed596709ebad..5e7a0cb3fb39 100644
--- a/opencti-platform/opencti-graphql/tests/03-streams/00-Raw/raw-test.js
+++ b/opencti-platform/opencti-graphql/tests/03-streams/00-Raw/raw-test.js
@@ -42,7 +42,7 @@ describe('Raw streams tests', () => {
       expect(updateEventsByTypes['campaign'].length).toBe(7);
       expect(updateEventsByTypes['relationship'].length).toBe(8);
       expect(updateEventsByTypes['identity'].length).toBe(11);
-      expect(updateEventsByTypes['malware'].length).toBe(13);
+      expect(updateEventsByTypes['malware'].length).toBe(15);
       expect(updateEventsByTypes['intrusion-set'].length).toBe(4);
       expect(updateEventsByTypes['data-component'].length).toBe(2);
       expect(updateEventsByTypes['location'].length).toBe(12);
@@ -65,7 +65,7 @@ describe('Raw streams tests', () => {
       expect(updateEventsByTypes['threat-actor'].length).toBe(17);
       expect(updateEventsByTypes['vocabulary'].length).toBe(3);
       expect(updateEventsByTypes['vulnerability'].length).toBe(3);
-      expect(updateEvents.length).toBe(132);
+      expect(updateEvents.length).toBe(134);
       for (let updateIndex = 0; updateIndex < updateEvents.length; updateIndex += 1) {
         const event = updateEvents[updateIndex];
         const { data: insideData, origin, type } = event;
diff --git a/opencti-platform/opencti-graphql/tests/04-sync/00-Raw/sync-raw-test.js b/opencti-platform/opencti-graphql/tests/04-sync/00-Raw/sync-raw-test.js
index 4b59348e1a4c..279801461e69 100644
--- a/opencti-platform/opencti-graphql/tests/04-sync/00-Raw/sync-raw-test.js
+++ b/opencti-platform/opencti-graphql/tests/04-sync/00-Raw/sync-raw-test.js
@@ -1,15 +1,6 @@
 import { describe, expect, it } from 'vitest';
 import gql from 'graphql-tag';
-import {
-  ADMIN_USER,
-  API_TOKEN,
-  API_URI,
-  FIFTEEN_MINUTES,
-  PYTHON_PATH, queryAsAdmin,
-  RAW_EVENTS_SIZE,
-  SYNC_RAW_START_REMOTE_URI,
-  testContext,
-} from '../../utils/testQuery';
+import { ADMIN_USER, API_TOKEN, API_URI, FIFTEEN_MINUTES, PYTHON_PATH, queryAsAdmin, RAW_EVENTS_SIZE, SYNC_RAW_START_REMOTE_URI, testContext } from '../../utils/testQuery';
 import { execChildPython } from '../../../src/python/pythonBridge';
 import { checkPostSyncContent, checkPreSyncContent } from '../sync-utils';
 import { elAggregationCount } from '../../../src/database/engine';
@@ -80,12 +71,12 @@ describe('Database sync raw', () => {
       expect(vocabRemoved.map((v) => v.name)).toEqual([]);
       expect(vocabAdded.map((v) => v.name)).toEqual([]);
 
-      const plop = await elAggregationCount(testContext, ADMIN_USER, READ_DATA_INDICES, { types: ['Stix-Object'], field: 'entity_type' });
-      const maaaap = new Map(plop.map((i) => [i.label, i.value]));
-      expect(maaaap.get('Indicator')).toEqual(28);
-      expect(maaaap.get('Malware')).toEqual(27);
-      expect(maaaap.get('Label')).toEqual(13);
-      expect(maaaap.get('Vocabulary')).toEqual(335);
+      const counters = await elAggregationCount(testContext, ADMIN_USER, READ_DATA_INDICES, { types: ['Stix-Object'], field: 'entity_type' });
+      const countersMap = new Map(counters.map((i) => [i.label, i.value]));
+      expect(countersMap.get('Indicator')).toEqual(28);
+      expect(countersMap.get('Malware')).toEqual(27);
+      expect(countersMap.get('Label')).toEqual(13);
+      expect(countersMap.get('Vocabulary')).toEqual(335);
 
       // Post check
       await checkPostSyncContent(SYNC_RAW_START_REMOTE_URI, objectMap, relMap, initStixReport);
diff --git a/opencti-platform/opencti-graphql/tests/05-rules/located-at-located-test.js b/opencti-platform/opencti-graphql/tests/05-rules/located-at-located-test.js
index 4628fae3860d..08b6717760a6 100644
--- a/opencti-platform/opencti-graphql/tests/05-rules/located-at-located-test.js
+++ b/opencti-platform/opencti-graphql/tests/05-rules/located-at-located-test.js
@@ -33,9 +33,9 @@ describe('Located at located rule', () => {
       expect(beforeActivationRelations.length).toBe(0);
       // ---- base
       // HIETZING > located-in > FRANCE (Start: 2020-02-29T23:00:00.000Z, Stop: 2020-02-29T23:00:00.000Z, Confidence: 30)
-      // BRETAGNE > located-in > FRANCE (Start: none, Stop: none, Confidence: 0)
-      // FRANCE > located-in > WESTERN EUROPE (Start: none, Stop: none, Confidence: 0)
-      // WESTERN EUROPE > located-in > EUROPE  (Start: none, Stop: none, Confidence: 0)
+      // BRETAGNE > located-in > FRANCE (Start: none, Stop: none, Confidence: 100)
+      // FRANCE > located-in > WESTERN EUROPE (Start: none, Stop: none, Confidence: 100)
+      // WESTERN EUROPE > located-in > EUROPE  (Start: none, Stop: none, Confidence: 100)
       // ---- inferences that will be created
       // HIETZING > located-in > WESTERN EUROPE (Start: 2020-02-29T23:00:00.000Z, Stop: 2020-02-29T23:00:00.000Z, Confidence: 15)
       // HIETZING > located-in > EUROPE (2 explanations) (Start: 2020-02-29T23:00:00.000Z, Stop: 2020-02-29T23:00:00.000Z)
@@ -46,24 +46,25 @@ describe('Located at located rule', () => {
       const afterActivationRelations = await getInferences(RELATION_LOCATED_AT);
       const hietzingToWesternEurope = await inferenceLookup(afterActivationRelations, HIETZING, WESTERN_EUROPE, RELATION_LOCATED_AT);
       expect(hietzingToWesternEurope).not.toBeNull();
-      expect(hietzingToWesternEurope.confidence).toBe(15); // AVG 2 relations (30 + 0)/2 = 15
+      expect(hietzingToWesternEurope.confidence).toBe(65); // AVG 2 relations (30 + 100)/2 = 65
       expect(hietzingToWesternEurope.start_time).toBe('2020-02-29T23:00:00.000Z');
       expect(hietzingToWesternEurope.stop_time).toBe('2020-02-29T23:00:00.000Z');
+      const franceToEurope = await inferenceLookup(afterActivationRelations, FRANCE, EUROPE, RELATION_LOCATED_AT);
+      expect(franceToEurope).not.toBeNull();
+      expect(franceToEurope.confidence).toBe(100);
+      expect(franceToEurope.start_time).toBe(FROM_START_STR);
+      expect(franceToEurope.stop_time).toBe(UNTIL_END_STR);
       const hietzingToEurope = await inferenceLookup(afterActivationRelations, HIETZING, EUROPE, RELATION_LOCATED_AT);
       expect(hietzingToEurope).not.toBeNull();
       // For confidence we have 2 explanations
-      // HIETZING > located-in > WESTERN EUROPE [Confidence: 15] > located-in > EUROPE [Confidence: 0] = 15/2 = 8
-      // HIETZING > located-in > FRANCE [Confidence: 30] > located-in > EUROPE  [Confidence: 0] = 30/2 = 15
-      expect(hietzingToEurope.confidence).toBe(12); // AVG 2 relations (8 + 15)/2 = 12
+      // HIETZING > located-in > WESTERN EUROPE [Confidence: 65] > located-in > EUROPE [Confidence: 100] = (65+100)/2 = 83
+      // HIETZING > located-in > FRANCE [Confidence: 30] > located-in > EUROPE  [Confidence: 100] = (30+100)/2 = 65
+      expect(hietzingToEurope.confidence).toBe(74); // AVG 2 relations (83 + 65)/2 = 74
       expect(hietzingToEurope.start_time).toBe('2020-02-29T23:00:00.000Z');
       expect(hietzingToEurope.stop_time).toBe('2020-02-29T23:00:00.000Z');
       expect(hietzingToEurope[RULE].length).toBe(2);
       expect(hietzingToEurope.i_inference_weight).toBe(2);
-      const franceToEurope = await inferenceLookup(afterActivationRelations, FRANCE, EUROPE, RELATION_LOCATED_AT);
-      expect(franceToEurope).not.toBeNull();
-      expect(franceToEurope.confidence).toBe(0);
-      expect(franceToEurope.start_time).toBe(FROM_START_STR);
-      expect(franceToEurope.stop_time).toBe(UNTIL_END_STR);
+
       // Create new element to trigger a live event
       // ---- base
       // PARIS > located-in > FRANCE (Start: 2020-01-20T20:30:00.000Z, Stop: 2020-02-29T10:00:00.000Z)
@@ -76,7 +77,7 @@ describe('Located at located rule', () => {
         toId: FRANCE,
         start_time: '2020-01-20T20:30:00.000Z',
         stop_time: '2020-02-29T10:00:00.000Z',
-        confidence: 100,
+        confidence: 50,
         relationship_type: RELATION_LOCATED_AT,
         objectMarking: [TLP_CLEAR_ID],
       });
@@ -87,7 +88,7 @@ describe('Located at located rule', () => {
       // Inferences must have been created by the markings combination
       const parisToWesternEurope = await inferenceLookup(afterLiveRelations, PARIS, WESTERN_EUROPE, RELATION_LOCATED_AT);
       expect(parisToWesternEurope).not.toBeNull();
-      expect(parisToWesternEurope.confidence).toBe(50); // AVG 2 relations (100 + 0) = 50
+      expect(parisToWesternEurope.confidence).toBe(75); // AVG 2 relations (100 + 50)/2 = 75
       expect(parisToWesternEurope.start_time).toBe('2020-01-20T20:30:00.000Z');
       expect(parisToWesternEurope.stop_time).toBe('2020-02-29T10:00:00.000Z');
       const parisToWesternEuropeMarkings = parisToWesternEurope[RELATION_OBJECT_MARKING];
@@ -96,7 +97,7 @@ describe('Located at located rule', () => {
       expect(parisToWesternEuropeMarkings.includes(TLP_TEST_INSTANCE.internal_id)).toBeTruthy();
       const parisToEurope = await inferenceLookup(afterLiveRelations, PARIS, EUROPE, RELATION_LOCATED_AT);
       expect(parisToEurope).not.toBeNull();
-      expect(parisToEurope.confidence).toBe(38);
+      expect(parisToEurope.confidence).toBe(82); // AVG 2 relations (75 + ((75+100) / 2)) / 2 = 82
       expect(parisToEurope[RULE].length).toBe(2);
       const parisToEuropeMarkings = parisToEurope[RELATION_OBJECT_MARKING];
       expect(parisToEuropeMarkings.length).toBe(1); // TLP:TEST
diff --git a/opencti-platform/opencti-graphql/tests/05-rules/observe-sighting-test.js b/opencti-platform/opencti-graphql/tests/05-rules/observe-sighting-test.js
index cbde443538dd..7fe35183b8b6 100644
--- a/opencti-platform/opencti-graphql/tests/05-rules/observe-sighting-test.js
+++ b/opencti-platform/opencti-graphql/tests/05-rules/observe-sighting-test.js
@@ -49,10 +49,13 @@ describe('Observed sighting rule', () => {
         x_opencti_detection: false,
         start_time: '2020-01-10T00:00:00.000Z',
         stop_time: '2020-02-20T00:00:00.000Z',
-        confidence: 100,
+        confidence: 50,
         relationship_type: RELATION_BASED_ON,
         objectMarking: [TLP_CLEAR_ID],
       });
+      // base: OBSERVED_FILE sighted in ANSSI (confidence 100)
+      // Create relation CBRICKSDOC based on OBSERVED_FILE (confidence 50)
+      // inferred: CBRICKSDOC sighted in ANSII
       const afterLiveRelations = await fetchInferences();
       expect(afterLiveRelations.length).toBe(1);
       const cbrickToAnssi = await inferenceLookup(afterLiveRelations, CBRICKSDOC, ANSSI, STIX_SIGHTING_RELATIONSHIP);
@@ -61,7 +64,7 @@ describe('Observed sighting rule', () => {
       expect(cbrickToAnssi.first_seen).toBe('2020-02-25T09:02:29.040Z');
       expect(cbrickToAnssi.last_seen).toBe('2020-02-25T09:02:29.040Z');
       expect(cbrickToAnssi.attribute_count).toBe(1);
-      expect(cbrickToAnssi.confidence).toBe(0);
+      expect(cbrickToAnssi.confidence).toBe(100); // RULE_MANAGER_USER has confidence 100
       expect(cbrickToAnssi.i_inference_weight).toBe(1);
       expect((cbrickToAnssi.object_marking_refs || []).length).toBe(0);
       // Change the organization
@@ -86,7 +89,7 @@ describe('Observed sighting rule', () => {
       expect(cbrickToMitreRescan.first_seen).toBe('2020-02-25T09:02:29.040Z');
       expect(cbrickToMitreRescan.last_seen).toBe('2020-02-25T09:02:29.040Z');
       expect(cbrickToMitreRescan.attribute_count).toBe(1);
-      expect(cbrickToMitreRescan.confidence).toBe(0);
+      expect(cbrickToMitreRescan.confidence).toBe(100);
       expect(cbrickToMitreRescan.i_inference_weight).toBe(1);
       expect((cbrickToMitreRescan.object_marking_refs || []).length).toBe(0);
       // Cleanup
diff --git a/opencti-platform/opencti-graphql/tests/utils/testQuery.ts b/opencti-platform/opencti-graphql/tests/utils/testQuery.ts
index b566f0d87c14..5019fdf4bb6b 100644
--- a/opencti-platform/opencti-graphql/tests/utils/testQuery.ts
+++ b/opencti-platform/opencti-graphql/tests/utils/testQuery.ts
@@ -22,7 +22,7 @@ export const SYNC_LIVE_START_REMOTE_URI = conf.get('app:sync_live_start_remote_u
 export const SYNC_DIRECT_START_REMOTE_URI = conf.get('app:sync_direct_start_remote_uri');
 export const SYNC_RESTORE_START_REMOTE_URI = conf.get('app:sync_restore_start_remote_uri');
 export const SYNC_TEST_REMOTE_URI = `http://api-tests:${PORT}`;
-export const RAW_EVENTS_SIZE = 942;
+export const RAW_EVENTS_SIZE = 944;
 export const SYNC_LIVE_EVENTS_SIZE = 594;
 
 export const PYTHON_PATH = './src/python/testing';
diff --git a/opencti-worker/src/worker.py b/opencti-worker/src/worker.py
index 6ce20520dae5..eb0fdefc72e7 100644
--- a/opencti-worker/src/worker.py
+++ b/opencti-worker/src/worker.py
@@ -334,13 +334,10 @@ def data_handler(  # pylint: disable=too-many-statements, too-many-locals
         except Exception as ex:  # pylint: disable=broad-except
             error = str(ex)
             error_msg = traceback.format_exc()
-            if (
-                "LOCK_ERROR" in error_msg
-                and self.processing_count < MAX_PROCESSING_COUNT
-            ):
+            if "LOCK_ERROR" in error_msg:
                 bundles_lock_error_counter.add(1)
                 # Platform is under heavy load:
-                # wait for unlock & retry almost indefinitely.
+                # wait for unlock & retry indefinitely.
                 sleep_jitter = round(random.uniform(10, 30), 2)
                 time.sleep(sleep_jitter)
                 self.data_handler(connection, channel, delivery_tag, data)