It is currently unclear how to encode information such as "it is better to hide these media attachments by default", whether you want to call that "sensitive content" or "not safe for work". In Mastodon internal representation, sensitive is a boolean on a status (note) itself, but for the sake of AP that could be expressed on the Document objects in the attachment field instead.