Governance refers to Data Governance in MDM.
...
| Governance... | |
|---|---|
| references | where the Master Data is stored |
| provides | visibility to data between zones and adaptors |
| contains |
|
ACLs and ACL Chains
ACLs are a key component of YOUnite and are different from permissions in that they control where data flows through the system. Permissions control who can manage zones, users, groups, permissions, and roles.
An ACL chain can be thought of as a series (chain) of policies (ACLs) that can be applied to a data event that occurs in the MDM ecosystem.
...
Operation ACLs are not part of zone data governance but should be mentioned briefly here. By default, the DGS has permission to modify ACLs to . Operational ACLs set policies that set forth for a given data domain version:
- What zone can or can't POST or DELETE data records (DRs)
...
TODO: Add a POST/DELETE chart
ACLs Illustrated
TODO - Survey examples
...
- .
- What adaptors or can't POST or DELETE data records (DRs).
There is a single system-wide chain for Operational ACLs that is controlled by the DGS. By default all zones and adaptors can POST and DELETE data records but POST and DELETE polices for data records can be controlled by the DGS.
Operational ACL policies can be on the following:
| Entity | Description |
|---|---|
| Domain Version | The domain version an operational ACL applies to. |
Source Zone | The zone that is allowed to or, restricted from POSTing a data record (DR). |
| Source Adaptor | The adaptor that is allowed to or, restricted from POSTing a data record (DR). |
| Allow POST / Restrict POST | Allow or restrict the source zone or adaptor from creating a data record for the given domain version. |
| Allow DELETE / Restrict DELETE | Allow or restrict the source zone or adaptor from deleting a data record for the given domain version. |
ACLs Illustrated
A very simple example it illustrate this point:
- There are four zones: ZoneW, ZoneX, ZoneY and ZoneZ each with only one adaptor. All adaptors are capable of storing/retrieving data entries for the "Customer" domain
- ZoneW has the following outbound ACL chain
...
| Source Zone | Destination Zone | Destination Adaptor | Domain Version | Policy |
|---|---|---|---|---|
| ZoneW | ZoneY | ALL |
...
| ALL | ALLOW | |||
| ZoneW | ALL | ALL | ALL | RESTRICT |
- A Customer PUT data event is raised on adaptor1 in ZoneW
- YOUnite can see that the adaptors in ZoneX, ZoneY and ZoneZ are all capable of consuming this data event
- YOUnite attempts to route the data event to ZoneX
- YOUnite inspects ZoneW's outbound ACL chain and gets a match on the first ACL in the chain and routes the event to the adaptor in ZoneX
- YOUnite attempts to route the data event to ZoneY
- The first ACL does not match but the second does restricting the event, so the data event is NOT routed to ZoneY
- ZoneZ
- YOUnite attempts to route the data event to ZoneX
...
TODO: Illustrate this
Examples worth mentioning:
Outbound ACL entry that includes domain properties:
- Need to include "allow" PUT and/or POST for them to take effect.
- The domain properties are a list of properties that should be restricted from flowing outbound
- The domain properties are ignored when "restrict" (e.g. restrict PUT or POST) is used since restrict is applied to the entire data event.
As mentioned above, governance provides visibility to data between zones and adaptors. This is typically managed by the ZDS, implemented with Access Control Lists (ACLs). ACLs are a key component of YOUnite. ACLs are different from permissions in that they control access to data. Permissions control who can manage zones, users, groups, permissions, and roles.
ACLs control both:
- Permissions on outbound data
- Controls on what inbound data a zone or adaptor should receive
TODO: Redraw and move to the top and re-use down here
For example, if an update (PUT or PATCH) operation is performed on data under YOUnite control, ACLs would control:
...
- is restricted as well
TODO HERE
Example Outbound ACLs for GET
...
- On the diagram's left side is a source zone’s single Source Adaptor (abcd-1234) that sends data changes (data records) in its domain(s) to the router.
- Note: A zone can have many adaptors.
- The data records sent from the source adaptor to the router have Operational ACL applied to them. Operational ACL limits which data operations are allowed from the source zone’s adaptor(s) and adaptor domain(s) and are defined by the zone's DGS.
- Next, the data records from the source zone’s domains/adaptors are linked to YOUnite Data Records to avoid data record duplication.
- Note: The data records published by the source adaptor could be updates, deletes, or new records.
- Outbound ACLs then get applied to the source adaptor’s data records. The Outbound ACLs are defined by the source zone’s ZDS and define what data the Zone can send out (i.e .restricting data, or elements of data, of certain domains from flowing out of certain adaptors in the zone to other zones).
- After Outbound ACLs are applied the data records are published to the YOUnite Data Hub and subscribing/desitnation zones and their adaptors (on the diagram's right side) are notified of the updated data.
- Any destination zone that has subscribed to data records from the source zone has Inbound ACLs in place to define which data operations are allowed in the source zone and its adaptor(s). Inbound ACL is defined by the destination zone’s ZDS. Any data or operations that are configured to be ignored are filtered out. The Destination Adaptor (zyxw-9876) in the image above is shown receiving data records and/or operations it has subscribed to, as filtered by its zone’s Inbound ACL.
...