Data Quality Service  ·  View 19 of 20  ·  Assurance

Security Zones

Five zones, and the one boundary that is easy to miss: a verdict must not become a side channel.

Editable source SVG draw.io All views
Zone 0 · Corporate — people and their groups Data engineer authors rules Data steward grants overrides Analyst reads state Auditor reads the log Zone 1 · Presentation — authenticated, authorised, no data Identity provider OIDC · groups Quality console state · scorecards State API no row values Zone 2 · Control — intent, never data Rule catalogue definitions only Override service owner-scoped Audit log Object Lock · 7 yr Zone 3 · Evaluation — the only zone that sees rows Workload identity scoped to targets Evaluators UC grants enforced Sample redactor ids, not values Zone 4 · Data — classified, masked, custodial Delta Lake on S3 read-only to this service Quarantine tables source classification kept Verdict store outcomes, not payloads authenticate state read override immutable record redacted samples Security Zones — A Verdict Must Not Become a Side Channel Person or role Security / platform Application we own Interface / broker Data store synchronous event / async Arrows out of Zone 3 are unlabelled because their direction is the whole statement: rows only ever move downward, into the data zone. The boundary that is easy to miss is inside Zone 3 — an author who cannot read a column must not be able to write an assertion whose failure message prints it, so redaction happens before a verdict crosses into anything a broader audience can query. v 1.0 · owner Data Platform Architecture · date 2026-09

Decisions

  • Zone 3 is the only zone that sees rows, and it runs under a workload identity scoped to the assertion's registered targets — never a standing credential broader than their union (ADR-14).
  • An author who cannot read a column must not be able to write an assertion whose failure message prints it. Redaction happens in Zone 3, before a verdict crosses into anything a broader audience can query.
  • Quarantine inherits the source dataset's classification and masking policy, so it never becomes a lower-governance copy of regulated data (ADR-15).

Assumptions

  • Unity Catalog grants are enforced during evaluation rather than re-implemented; the service holds no independent access model for data.
  • Violation samples emit row identifiers, not row contents, for every column not explicitly classified non-sensitive.

Risks

  • Column classification is the dependency this control rests on. One misclassified column and redaction lets a value through — which is why the default is to redact and the exception must be declared.
  • Arrows out of Zone 3 are unlabelled deliberately: their direction is the whole statement, since rows only ever move downward into the data zone.
◀  Observability All views Identity and Override Flow  ▶
Solution Architecture v1.0 · Databricks Lakehouse on AWS · Data Platform Architecture · 2026-09 · 20 views · 16 architecture decision records19-security-zones