05 Governance and security#

1 Governance roles

The people responsible for data and what each of them decides: owners, stewards, custodians, consumers and the platform team.

2 Data contracts

A data contract is a written, machine-readable agreement between the producer of a dataset and its consumers about its structure, meaning, quality and service levels, checked automatically.

3 Data quality dimensions

The aspects in which data can be good or bad, such as accuracy, completeness and timeliness, and how each is measured and watched in production.

4 Catalog and lineage

A business data catalog is where people find, understand and trust data: it lists datasets with their descriptions, owners, terms and quality, and shows lineage, the path data takes from sources to reports.

5 Governance as code Optional

Keeping governance decisions, such as owners, classification tags, glossary links, access grants and policies, in version-controlled files, and having automation apply and check them, instead of setting them by hand in each tool.

6 Authentication and authorization: OIDC and JWT

Authentication establishes who is making a request; authorization decides what they may do. In modern platforms, identity comes from a central identity provider through OpenID Connect and OAuth 2.0, carried to each service as a signed token, often a JWT.

7 RBAC and ABAC

Two ways to decide what an authenticated user may do: role-based access control (RBAC) grants permissions to roles and puts users in roles; attribute-based access control (ABAC) evaluates rules over attributes of the user, the data and the request.

8 Row-level security and masking

Row-level security limits which rows of a table a user can see; column masking changes what they see in sensitive columns, for example showing only the last four digits of a card number.

9 Multi-tenancy

Serving several customers or organisations, called tenants, from one platform while keeping each tenant's data separate and preventing one tenant's load from affecting the others.

10 PII and data classification

Identifying which data relates to people or is otherwise sensitive, labelling it with a classification level, and handling it according to that level, including pseudonymising or anonymising it where possible.

11 Privacy lifecycle

Managing personal data from collection to deletion: keeping it only as long as it is needed, archiving or deleting it on schedule, and erasing one person's data everywhere when they ask.

12 Residency and regions

Keeping data in the geographic locations that law, contracts or customers require, while still allowing analysis that spans regions.

13 Encryption and key management

Protecting data by making it unreadable without a key, both while it moves between systems and while it is stored, and managing those keys so that the right systems can use them and nobody else can.

14 Audit logging

Recording who did what to which data, and when: logins, queries, access changes and administrative actions, kept so that they can be searched later and cannot be quietly altered.