Governance, Privacy & Access
Classification, PII, minimization, retention, access control, masking and deletion — applied to datasets and pipelines rather than to endpoints.
Ownership, classification, access, retention and auditability as five mechanisms with enforcement points — not as a document in a wiki.
Public, internal, confidential, personal, highly sensitive — what the tiers mean, why the unit is the column, and why classification is worthless unless it propagates.
Where personal data actually ends up in a data platform: raw landing zones, debug logs, error messages carrying rows, notebook extracts, training sets, and the temporary table nobody deleted.
Store only what is needed — against the equally correct rule that says keep everything because you cannot recreate it. Both are right, and the resolution is structural.
How long should this dataset exist? A retention horizon is simultaneously a recovery window and a liability window, and the two want opposite numbers.
Least privilege applied to five surfaces — warehouse, lake, catalog, pipelines and secrets — where the weakest one is the effective policy and the pipeline is the most over-privileged principal you have.
An analyst sees EU rows only; a column comes back masked. Where that policy is evaluated decides whether it is a control or a convention — and a row filter silently changes what an aggregate means.
Four different techniques that people call masking. Which joins survive, who can reverse it, and why hashing a low-cardinality field is reversible by anyone with a loop.
A person asks to be erased from a platform built on immutable files, replayable logs and forty copies — and the backfill you run next week can bring them back.