Data groups and data owners
An admin puts APIs, data sets and fields into data groups. Groups follow your business domains, such as finance, operations or HR, not a ladder of levels. Each group has a data owner, who decides every request for its data. A person’s access is the sum of the groups they hold, and there is no deny group.
Two grants for people, one for tools
| Who | Grants, in order |
|---|---|
| The person who builds | 1. Enrolment: sees which data exists and its shape, no records. 2. Authorisation: reads the data, once the data owner approves. |
| The tool they build | Authorisation: its own, approved separately by the data owner. Never wider than the requesting person’s enrolment. Stays with the tool if people change. |
A builder can build a tool that reads data they cannot read themselves. The builder saw the shape, the owner approved the tool, and the builder never handles the data or the credential.
Every grant has limits
- Every authorisation expires after a set time and is requested again.
- A data owner can cap how often a tool may call, so one runaway tool slows down without affecting others.
- Grants are made to a whole data group, never tool by tool, so the model stays small.
- Calls between tools on Substrait are data grants too; the called tool’s owner approves.
One gateway
Every call a tool makes to company data goes through Substrait’s gateway. The gateway holds the credential, encrypted and write-only, and attaches it to the call. An ungranted call is refused with the name of the missing grant. A withdrawn grant refuses the very next call, with no redeploy. Outbound traffic from a tool is denied unless a grant allows it, so the gateway is the only way out.
Data nobody granted you is invisible
A builder sees nothing of a data group they are not enrolled in: no name, no count, no gap. A compromised account therefore exposes no map of your data.
What the gateway reaches
Your systems’ APIs, the tools your people build on Substrait, your data warehouse through reviewed and versioned data sets, your reporting tools, and business systems such as SAP, Salesforce, Oracle, NetSuite, Microsoft Dynamics 365, SQL Server, SharePoint and Microsoft 365.
