# 05 Governance and security

Who is responsible for data and how promises about it are kept, how people find and trust it, and how access is controlled: identities and tokens, roles and attributes, row and column restrictions, tenants, personal data, retention and erasure, where data may live, how it is encrypted and how access is audited.

> [!NOTE]
>
> **Before starting**
>
> [01 Foundations](<https://wiki.4tm0.net/data/section-foundations.html>) to [04 Modelling and transformation](<https://wiki.4tm0.net/data/section-modeling.html>), in particular [Data products and data mesh](<https://wiki.4tm0.net/data/data-products-and-mesh.html>), [dbt](<https://wiki.4tm0.net/data/dbt.html>), [Testing data pipelines](<https://wiki.4tm0.net/data/testing-data-pipelines.html>) and [Iceberg maintenance](<https://wiki.4tm0.net/data/iceberg-maintenance.html>). The pages on authentication and access control can also be read on their own.

## Pages, in reading order

- 1 [Governance roles](<https://wiki.4tm0.net/data/governance-roles.html>)

  The people responsible for data and what each of them decides: owners, stewards, custodians, consumers and the platform team.
- 2 [Data contracts](<https://wiki.4tm0.net/data/data-contracts.html>)

  A data contract is a written, machine-readable agreement between the producer of a dataset and its consumers about its structure, meaning, quality and service levels, checked automatically.
- 3 [Data quality dimensions](<https://wiki.4tm0.net/data/data-quality-dimensions.html>)

  The aspects in which data can be good or bad, such as accuracy, completeness and timeliness, and how each is measured and watched in production.
- 4 [Catalog and lineage](<https://wiki.4tm0.net/data/catalog-and-lineage.html>)

  A business data catalog is where people find, understand and trust data: it lists datasets with their descriptions, owners, terms and quality, and shows lineage, the path data takes from sources to reports.
- 5 [Governance as code](<https://wiki.4tm0.net/data/governance-as-code.html>) Optional

  Keeping governance decisions, such as owners, classification tags, glossary links, access grants and policies, in version-controlled files, and having automation apply and check them, instead of setting them by hand in each tool.
- 6 [Authentication and authorization: OIDC and JWT](<https://wiki.4tm0.net/data/authn-vs-authz-oidc-jwt.html>)

  Authentication establishes who is making a request; authorization decides what they may do. In modern platforms, identity comes from a central identity provider through OpenID Connect and OAuth 2.0, carried to each service as a signed token, often a JWT.
- 7 [RBAC and ABAC](<https://wiki.4tm0.net/data/rbac-vs-abac.html>)

  Two ways to decide what an authenticated user may do: role-based access control (RBAC) grants permissions to roles and puts users in roles; attribute-based access control (ABAC) evaluates rules over attributes of the user, the data and the request.
- 8 [Row-level security and masking](<https://wiki.4tm0.net/data/row-level-security-masking.html>)

  Row-level security limits which rows of a table a user can see; column masking changes what they see in sensitive columns, for example showing only the last four digits of a card number.
- 9 [Multi-tenancy](<https://wiki.4tm0.net/data/multi-tenancy.html>)

  Serving several customers or organisations, called tenants, from one platform while keeping each tenant's data separate and preventing one tenant's load from affecting the others.
- 10 [PII and data classification](<https://wiki.4tm0.net/data/pii-and-classification.html>)

  Identifying which data relates to people or is otherwise sensitive, labelling it with a classification level, and handling it according to that level, including pseudonymising or anonymising it where possible.
- 11 [Privacy lifecycle](<https://wiki.4tm0.net/data/privacy-lifecycle.html>)

  Managing personal data from collection to deletion: keeping it only as long as it is needed, archiving or deleting it on schedule, and erasing one person's data everywhere when they ask.
- 12 [Residency and regions](<https://wiki.4tm0.net/data/residency-and-regions.html>)

  Keeping data in the geographic locations that law, contracts or customers require, while still allowing analysis that spans regions.
- 13 [Encryption and key management](<https://wiki.4tm0.net/data/encryption-and-key-management.html>)

  Protecting data by making it unreadable without a key, both while it moves between systems and while it is stored, and managing those keys so that the right systems can use them and nobody else can.
- 14 [Audit logging](<https://wiki.4tm0.net/data/audit-logging.html>)

  Recording who did what to which data, and when: logins, queries, access changes and administrative actions, kept so that they can be searched later and cannot be quietly altered.

## Previous and next section

[04 Modelling and transformation](<https://wiki.4tm0.net/data/section-modeling.html>) · [06 Serving](<https://wiki.4tm0.net/data/section-serving.html>)