Data Quality Service  ·  View 20 of 20  ·  Assurance

Identity and Override Flow

Who may block, who may let a block through, and why nothing here has a path to a permanent exemption.

Editable source SVG draw.io All views
Data steward Identity provider Rule + override API Tier + policy registry Override service Audit log State index 1. OIDC sign-in 2. token + group claims 3. is this actor the dataset's owner or delegate? 4. yes — payments domain steward 5. override block on v41207, 48 h 6. require justification, reject if absent 7. create override with expiry 8. actor · reason · expiry · approver 9. state: blocked, override active 10. version promotable until expiry 11. at expiry: state reverts, debt raised 12. override on another team's dataset 13. refused — not the owner Identity Flow — Who May Block, and Who May Let It Through The override is an object with an owner and an expiry, not a flag. At expiry the state reverts by itself and the debt register carries the item — which is why nothing here has a path to a permanent exemption. v 1.0 · owner Data Platform Architecture · date 2026-09

Decisions

  • The override is an object with an owner, a justification and an expiry — not a flag. At expiry the state reverts by itself and the debt register carries the item (ADR-16).
  • Only the dataset's owning team or a named delegate may author a blocking assertion, grant an override, or retire an assertion. The policy registry answers that question, not the API (ADR-13).
  • Every grant is written to an immutable log with actor, reason, expiry and approver before the state changes, so the record cannot be the thing that failed (ADR-14).

The refusal path

  • The last two messages are the cross-domain attempt: a steward acting on another team's dataset is refused by the policy registry, not by convention.
  • A justification is mandatory and structurally enforced — the API rejects an override without one rather than recording an empty string.

Assumptions

  • OIDC with group claims from the corporate identity provider; 48 h is an illustrative override window against a 7-day default ceiling. Stated assumptions.
  • Suppressions follow the same lifecycle as overrides: expiry mandatory, unbounded suppression unsupported.
◀  Security Zones All views
Solution Architecture v1.0 · Databricks Lakehouse on AWS · Data Platform Architecture · 2026-09 · 20 views · 16 architecture decision records20-identity-and-override-flow