Customer 360 Enterprise Data Platform — Denodo on Azure  ·  View 03 of 39  ·  Context and scope

The Governing Principle

Which responsibilities Denodo takes, and which it must be prevented from taking.

Editable source SVG draw.io All views
Denodo Platform — owns the access contract Semantic Model one Customer360 Federated Execution pushdown, MPP Policy Enforcement row, column, mask Data Services SQL, REST, GraphQL Catalog and Lineage certified assets Specialist platforms — own the truth Identity Entity Resolution Zingg on Spark ECID Crosswalk Survivorship Rules versioned in Git History and models Delta Lakehouse CLV and Segments daily model run Pre-aggregations Movement Event Hubs Stream Processing Spark Streaming Systems of record Salesforce SAP S/4HANA ServiceNow joins ECID reads gold reads live applies The Governing Principle — Denodo Owns Access, Not Truth Application we own Data store Queue / topic External / third party synchronous batch No box in the upper container stores an authoritative customer fact. Removing Denodo would slow every consumer down; it would not lose a record. v 1.0 · owner Data & AI Global Practice · date 2026-09

The decision the rest of the set follows from

  • Denodo owns the access contract: the semantic model, federated execution, policy enforcement, data services and lineage. It owns no authoritative fact.
  • Identity mastering, large-scale history, streaming and the systems of record each keep the job they are best at. Denodo joins their output; it does not absorb it.
  • Test of the principle: deleting the whole Denodo estate would slow every consumer down and lose no record. If that ever stops being true, something has been built in the wrong place.

Why identity resolution is not done in views

  • Deterministic matching in a virtual view is possible and tempting. Probabilistic matching, survivorship, duplicate review and a stable enterprise id are not — they need state, a training set, a review queue and an audit trail.
  • Attempting it in VQL produces rules nobody can test and a customer id that changes when the view changes.

Risks

  • The principle erodes quietly. A cached view with business logic in it becomes a system of record by accident; the CI policy scan on view 30 exists to catch that.
  • One logical layer in front of every consumer is a concentration risk with no technical mitigation. It is managed by workload isolation, not designed away.
◀  High-Level Architecture All views Actors and Their Core Journeys  ▶
Solution Architecture v1.0 · Data & AI Global Practice · 2026-09 · 39 views · Denodo Platform, Microsoft Azure and open source03-access-not-truth