You are here:
Tagging, Policies, and Access in Data Cloud One
Data Cloud One uses the same tagging, policy creation, and access management as the rest of Data 360, with added specifications. For both tagging and policy creation in Data Cloud One, the home org functions as a standalone org that can perform further syncing.
Tag Management
In Data Cloud One, you can create tags, taxonomy, and classification only in the home org. During the initial Data Cloud One setup, a “day zero” sync transfers all existing governance artifacts from the home to the companion org. After the initial sync, automatic, incremental updates keep both orgs aligned. These syncs can occur before or after you enable Data Cloud One features, and regardless of when the tags were first created.
Tag Assignment
Tag assignment in companion orgs has these restrictions.
- Users can assign tags within the companion org, but only to objects that were created locally within that specific companion org.
- Object tags for objects created in home orgs automatically sync to companion orgs. These objects’ tag assignments can’t be changed in the companion org.
Tag Propagation
In a home org, tags can propagate between parent and child objects created in the org.
In a companion org, updates to home org objects automatically sync to the objects’ synced counterparts. The changes don’t automatically propagate to locally-created objects built on top of them. To propagate them, manually sync the home org-synced object to the local object.
Tags can’t be propagated between synced objects.
This table displays how the tag and taxonomy capabilities between home and companion orgs.
| Task | Home Org | Companion Org |
|---|---|---|
| Tag and Taxonomy Creation | Yes | Home org admins can create new tags and taxonomies and make them available to companion orgs. You can only assign tags in companion orgs to the objects that were created there. |
| Taxonomy sync | Standard and Custom taxonomies are available for all companion orgs. | Users with permissions can view taxonomies shared by the home org. |
| Tag Assignment: Home org objects | Yes | Admins can’t change home org objects’ tag assignments. |
| Tag Assignment: Companion org objects | No | Admins can assign tags to any objects or process definitions created locally in the org. |
| Tag Propagation | Tags propagate from parent to child objects. These tags automatically propagate to synced home org objects in the companion org. | Tags can be manually propagated from synced home org objects to child objects locally-created in the companion org. They can also be propagated between parent local objects and their children. |
Policy Management
Policies aren’t automatically synced from the home org to companion orgs. Instead, companion orgs can create their own policies and apply them to the tags and classifications synced from the home org. This includes both tag-based and non-tag based policies such as row-level security policies.
| Task | Home Org | Companion Org |
|---|---|---|
| Policy Creation | Yes | Yes |
| Policy sync | Policies don’t sync to companion orgs. | Policies don’t sync to other companion orgs. |
| Policy Application: Tags | Can apply policies to locally-created tags and classifications. | Can apply policies to synced tags and classifications from the home org. |
| Policy Application: Non-Tags | Can create and apply. | Can create and apply. |
| Policy Scope | Applies to all home org content. | Applies only to local content and synced metadata. |
Licensing and Access
Licensing control resides in the home org. Companion orgs gain access to features only when the corresponding add-ons are purchased through the home org.
