Governance

Governance refers to Data Governance in MDM.

What is Governance?

Governance describes the act of managing data access (i.e. who accesses certain data sets based on role, application, etc.).

ACLs and ACL Chains

 ACLs are a key component of YOUnite and are different from permissions in that they control where data flows through the system. Permissions control who can manage zones, users, groups, permissions, and roles.

An ACL chain can be thought of as a series (chain) of policies (ACLs) that can be applied to a data event that occurs in the MDM ecosystem.

ACLs

An access control list, or ACL, is a list of properties that when combined, create a policy that controls data flow between zones and adaptors. The list of ACL properties includes:

• Source Zone - The zone the data originated from
  • Source Adaptor - The adaptor the data originated from
• Destination Zone - The zone the data is flowing to
  • Destination Adaptor - The adaptor the data is flowing to
• Domain Version - The data domain the ACL applies to
  • Domain Version Properties - One or more properties in the data domain that are applied to the ACL
• Data Records - One or more data records that are applied to the ACL
• Allow/Deny settings for an ACL control which operations are either allowed or denied:
  • GET
  • PUT
  • POST
  • DELETE

Data events in YOUnite parallel the HTTP requests GET, PUT, POST and DELETE.

Not all ACL types use all of the ACL properties.

ACL Chains

ACLs are linked together to form ACL chains. They behave similar to network firewall chains but apply to an organizations data entities linked to YOUnite. When a data event occurs to a source entity, the change is transmitted to the YOUnite Router and the appropriate ACL chains are consulted and data is propagated (allowed) or restricted based on the ACLs in the ACL chains. Care must be taken to order the ACLs on a chain properly since the first ACL match is applied to a data event.

Types of ACLs

There are three types of ACLs:

• Inbound ACLs
• Outbound ACLs
• Operational ACLs

Each zone has both an inbound and outbound ACL chain which are controlled by the zone data steward.

Operational ACLs control which zones can create or delete a federated data record for a specific domain version. Operational ACLs are controlled by the Data Governance Steward.

Outbound ACLs

Outbound ACLs can be thought of as policies on out-bound data. By default, all ACLs are open. Outbound ACLs are the controls a Source Zone's data steward sets on Destination Zones:

Polices can be set on the following:

Inbound ACLs

Inbound ACLs can be thought of as policies on in-bound data. By default, all ACLs are open. Inbound ACLs are the controls a Destination Zone sets on Incoming data requests from Source Zones:

Policies can be set on the following - the zone data steward in the destination zone, creates the ACL on behalf of the destination zone:

Operational ACLs 

Operation ACLs are not part of zone data governance. Operational ACLs set policies that set forth for a given data domain version:

• What zone can or can't  POST or DELETE  data records (DRs). 
• What adaptors or can't  POST or DELETE  data records (DRs).

There is a single system-wide chain for Operational ACLs that is controlled by the DGS.  By default all zones and adaptors can POST and DELETE data records but POST and DELETE polices for data records can be controlled by the DGS.

Operational ACL policies can be on the following:

ACLs Illustrated

A very simple example it illustrate this point:

• There are three zones: Zone-X, Zone-Y and Zone-Z each with two adaptors. All adaptors are capable of storing/retrieving data entries for the Customer domain
• Zone-X has the following Outbound ACL Chain

_{ALL = GET, PUT, POST, DELETE}

1. A Customer PUT data event is raised on adaptor1 in Zone-X
2. YOUnite can see that the adaptors in ZoneY and ZoneZ are all capable of consuming this data event
   1. YOUnite attempts to route the data event to Zone-Y
      1. YOUnite inspects Zone-X's outbound ACL chain and gets a match on the first ACL in the chain and routes the  event to the two adaptors in Zone-Y
   2. YOUnite attempts to route the data event to Zone-Z
      1. The first ACL does not match but the second does restricting the event, so the data event is NOT routed to Zone-Z

Following is more involved example using the zones and adaptors from above. ACLs are evaluated from first to last, the first match is applied to an incoming data event:

_{ALL = GET, PUT, POST, DELETE}

After applying all of the above, the end result is:

• Zone-Y gets nothing
• Zone-Z is restricted from seeing the two DRs listed above
• No data from Zone-X's Adaptor2 flows to any zones or adaptors
• Zone-X never shares the Customer version 1 Domain property Customer.ssn  (for all adaptors in the outbound zones)

Complete ACL Data Flow Illustration

The image below represents the components involved as a data event is detected at an adaptor and flows through the YOUnite ecosystem.

• On the diagram's left side a source zone’s single Source Adaptor (Zone-X, Adaptor 1) detects a data event in the source system (ERP) and sends a data event (data record for a given domain version)  to the router.
• The data record sent from the source adaptor to the router have Operational ACL applied to them. Operational ACL limits which data operations are allowed (create/delete YOUnite Data Records)  from the source zone’s adaptor(s) and adaptor domain(s) and are defined by the zone's DGS.
• Next, the data records from the source zone’s domains/adaptors are linked to YOUnite Data Records to avoid data record duplication. 
  • Note: The data records published by the source adaptor could be updates, deletes, or new records.
• Outbound ACLs then get applied to the source adaptor’s data record (Zone-X, Adaptor 1). The Outbound ACLs are defined by the source zone’s ZDS and define what data the Zone can send out (i.e .restricting data, or elements of data, of certain domains from flowing out of certain adaptors in the zone to other zones).
• Destination zones have Inbound ACLs in place to define which data operations are allowed from source zones and their adaptor(s). Inbound ACL is defined by the destination zone’s ZDS. Any data or operations that are configured to be restricted are filtered out. 
• After Outbound ACLs are applied the data records are published to the YOUnite Data Hub Router and subscribing/desitnation zones and their adaptors (on the diagram's right side) are notified of the updated data.