Home / Data Platform / Governance

Data PlatformChecklistIntermediate

Data governance foundation: catalog, lineage, classification and access requests

The minimum governance setup that makes a data platform supportable, covering scanning and cataloguing, ownership, sensitive data classification, lineage, access request workflow and audit.

Deepak Bhardwaj2 min read

Applies toMicrosoft Purview, Databricks Unity Catalog, AWS Glue Data Catalog / DataZone, OCI Data Catalog

Support teams feel governance gaps first: "who owns this table?", "can I give this user access?", "which reports break if we change this column?". This checklist answers those.

1. Catalogue

  • Every production source and the lakehouse/warehouse registered and scanned on a schedule.
  • Business glossary for key terms (Customer, Active Customer, Revenue) linked to assets.
  • Each gold data product has a description, owner, steward, refresh SLA and contact channel.

2. Ownership

  • Data owner (business) approves access; data steward maintains definitions and quality; technical owner runs the pipeline.
  • Owners recorded in the catalog, not in a spreadsheet.

3. Classification

  • Automatic classification (PII, financial, health) on scans.
  • Sensitive columns tagged; masking policies applied:
-- Unity Catalog column mask example
CREATE FUNCTION prod.security.mask_email(email STRING)
RETURN CASE WHEN is_account_group_member('pii-readers') THEN email ELSE regexp_replace(email, '^[^@]+', '***') END;

ALTER TABLE prod.silver_crm.customers ALTER COLUMN email SET MASK prod.security.mask_email;

4. Lineage

  • Lineage captured automatically from the engines (Unity Catalog lineage, Purview with ADF/Synapse/Fabric, OpenLineage from Airflow/dbt).
  • Used in change management: before altering a column, check downstream tables and reports.

5. Access workflow

  • Self-service access requests in the catalog (or ITSM) routed to the data owner.
  • Grants to groups; time-limited access for exceptions.
  • Quarterly access reviews on sensitive datasets.

6. Quality and SLAs

  • Freshness and volume checks on gold tables, results visible in the catalog or a status page.
  • Incidents on data products recorded with the data product name, so recurring problems are visible.

7. Audit

  • Query and access audit logs retained (Unity Catalog system.access.audit, Purview audit, CloudTrail Lake).
  • Reports for "who accessed PII in the last 30 days".

DR consideration

The catalog and its policies are part of the platform. If Purview, Unity Catalog metastore or Glue Catalog configuration can't be restored or rebuilt in the DR region, access control and masking won't work after failover. Keep policies as code and check how your catalog service handles regional outages.

Related fixes