You are here:
Control Data Graph Access
Data graph governance in Data 360 controls how you access data by enforcing permissions at the object and field levels, so you see only the data you’re permitted to access. Governance policies are defined using tags inherited from source data model objects (DMOs) and applied to the data graph.
Required Editions
| Available in: All Editions supported by Data 360. See Data 360 edition availability. |
When you query a data graph, Data 360 evaluates access dynamically:
- Removes objects you don’t have access to
- Removes or masks restricted fields
- Filters metadata for inaccessible objects and fields
Instead of denying the entire data graph, Data 360 returns only the data you can access.
Granular governance works with existing data graphs without requiring changes. Existing APIs continue to function. The difference is in how data is returned. Restricted objects and fields are filtered out. When granular governance is enabled, Data 360 automatically backfills governance tags for existing data graphs before the feature is enabled.
- Data graphs that were previously visible: Governance tags are automatically propagated to the data graph at rollout. Access becomes more granular. Instead of the entire data graph being blocked or fully accessible, you see only the objects and fields you're authorized to access. This is not a breaking change. Previously blocked objects and fields remain blocked, while accessible ones continue to be available.
- Data graphs that were not previously visible: Granular governance applies based on the
governance tags propagated from source DMOs and the policies available. Individual objects
and fields that you have access to become accessible, even if the data graph was previously
inaccessible as a whole.
Note With granular governance, access restrictions on child DMOs no longer prevent access to the entire data graph. As a result, users may gain visibility into objects or fields that are permitted by policy, even if the data graph was previously inaccessible as a whole. If you rely on child DMO restrictions to block access to an entire data graph, review your governance configuration and apply the appropriate governance tags or an explicit deny policy to the output DMO to prevent unintended visibility.
Governance Enforcement
Data 360 enforces governance policies across all access points. Under granular governance, Calculated Insights (CI) operate on an all-or-none basis. If you do not have access to even one field of a CI, you cannot see the entire CI node in the data graph response. This is different from regular DMOs, which are granularly pruned (allowing partial field visibility).
- API: Data 360 APIs enforce access controls on both data and metadata responses, including:
- UI: Governance is also enforced in the Data Graph UI. Objects and fields that you don’t have access to are hidden or masked.
Tags in Data Graphs
Tags define governance policies and control access to data in a data graph. Data graphs inherit tags from source data model objects (DMOs), and tags are applied at both the object and field levels.
Tags applied to a DMO are associated with the corresponding object in the data graph, and tags applied to DMO fields are associated with the corresponding fields. These tags determine which objects and fields users can access when querying the data graph.
Data graphs don't support direct tag assignment or management. All tags are managed at the DMO level and reflected in the data graph through propagation.
When you create a data graph, it automatically inherits tags from the underlying DMOs and fields.
To add tags, apply them to the source DMO or its fields, and then use the DMO UI to propagate them to data graphs and other services.
To update or remove tags, modify or remove them on the source DMO or its fields. Changes to tags on source DMOs aren't applied immediately to existing data graphs. A data graph can temporarily reflect previously applied tags until tags are reapplied to synchronize it with the latest configuration.
Tag Manager doesn't support data graph objects or fields. Manage all tag additions, updates, and removals at the DMO level. To reflect updated tag configurations in a data graph, reapply tags on the data graph. Reapplying tags removes all existing tags on the data graph and replaces them with the current tags inherited from source DMOs and fields.
- Reapply Tags for a Data Graph
After updating or removing tags at the DMO level, reapply tags to synchronize a data graph with the latest tag configuration from its source DMOs. When you reapply tags, all existing tags on the data graph are removed and replaced with the current tags from source DMOs and fields.
