Review this catalogue rollout. Every employee can read every entry. Each table page shows column names, descriptions, row counts, five sample rows harvested nightly, the top ten queries and the names of the people who ran them. Nothing in the catalogue carries a sensitivity label yet - labelling is phase two. What would you remove, what would you change, and what would you leave alone?

What is actually required

A catalogue earns its keep by answering three questions: does a dataset for this exist, can I trust it, and who do I ask. Search over names, descriptions, owners, freshness and lineage does all three. Nothing in that list requires showing anybody a value.

What I would remove

The sample rows. This is the single change. The catalogue has become a full-estate read path that no row policy, column mask or purpose check applies to, because the samples are harvested by a privileged service account and served as metadata. Five rows from a table of 200 million is not an anonymity property; it is five people's actual records, and the harvest repeats nightly so over a year it is 1,825 of them.

The querier names, as a default. "Who ran the top queries" on an HR or incident table is a disclosure about colleagues' work, not about data.

Row counts on narrow-cohort tables. A table named for a condition or an investigation leaks information through its count alone, and counts refreshed nightly leak changes.

The one change that matters

Metadata inherits the sensitivity of the data it describes, and the catalogue is a data consumer like any other. That single statement reorders the rollout: labels stop being phase two, because the catalogue cannot decide what to show until something tells it. The practical form is default-deny for values - samples, counts and profiles off unless a label says otherwise - with names, descriptions, owners and lineage open. Default-allow with a labelling backlog is a disclosure with a project plan attached.

What I would leave alone

Open search across the whole estate, and usage-derived ranking. Pinterest's Querybook, which the company publishes as open source, ranks table search by past query runs and surfaces a table's frequent users and sample queries - that is what turns an inventory into something people use, because popularity is the only trust signal available before anyone has written documentation. Keep it. The fix is to show the aggregate signal and gate the individual names, not to abandon ranking and go back to an alphabetical list nobody reads.

Also leave the nightly harvest itself. Manual entry is why catalogues rot; the problem is the payload, not the automation.

How I would argue this in the review

Not as a privacy objection, which invites a debate about likelihood. As a control-coverage objection: the estate has row policies, column masks and purpose-recorded access, and here is a path that evaluates none of them for every table at once. Then offer the small version - names and descriptions open on day one, values behind labels - so the answer is a sequence rather than a veto.

When this is the wrong answer

A 30-person company whose entire estate is already readable by every analyst has no gap to close: the catalogue discloses nothing that a query would not. Metadata access control is worth building exactly when the data access control it would mirror already exists. Building it first produces a catalogue that is harder to use than the warehouse, which is how a catalogue dies.