About governance workflows

Governance workflows let you set up automated controls and approval mechanisms for organizational data resources. With these workflows, you can help ensure that authorized individuals or teams manage access to your data products and curate catalog and glossary metadata.

Using governance workflows has the following benefits:

  • Data consumers can find relevant data products and request access directly within Knowledge Catalog (formerly Dataplex Universal Catalog), replacing manual support ticketing processes.
  • Upon request approval, the system automatically grants the required Identity and Access Management (IAM) roles and group memberships, eliminating manual administrative overhead and reducing time-to-access.
  • System logs capture audit trails of requests, justifications, approver decisions, and timestamps to support compliance auditing.
  • Centralized approval mechanisms for sensitive data assets help ensure that access and metadata updates are restricted to authorized users and teams.

Use cases

Governance workflows support automated access management and metadata curation across various scenarios:

  • Data product access management: a marketing manager or risk analyst requests access to a curated sales or transaction history data product to analyze customer behavior or build risk models. Upon approval, the required IAM roles are automatically provisioned.
  • Business glossary curation: an organization delegates creating and updating business glossary categories and terms to domain contributors or external contractors. Contractors submit governance requests for review by central data stewards before updating the glossary.
  • Catalog entry and batch metadata enrichment: data contributors or automated enrichment agents propose single or batch updates to catalog entries, such as creating custom entries, updating descriptions and aspects, or linking entries to business glossary terms. Data owners can review and approve the changes in a single workflow.

Use governance workflows in Knowledge Catalog

You can use governance workflows to request access to data products, request single-resource metadata changes to business glossaries and Knowledge Catalog entries, and request batch metadata changes for entries and entry links.

Concurrency

Multiple pending metadata change requests can coexist on a single resource. Knowledge Catalog uses a last writer wins model, which means the most recently approved change overwrites prior updates, regardless of when requests were submitted. Pending requests remain valid even if the resource is updated directly or by another approved request.

Supported metadata operations

The following table lists the resources and operations supported by metadata change requests:

Resource Create Update Delete
Glossary category Yes Yes Yes
Glossary term Yes Yes Yes
Entry Yes Yes Yes
Entry link Yes No Yes

Batch metadata change requests

You can use the Dataplex API to group metadata operations into a single change request.

Supported batch metadata operations

The following table lists the resources and operations supported by batch metadata change requests:

Resource Create Update Delete
Entry Yes Yes Yes
Entry link Yes Yes Yes

A batch metadata change request can originate in the following ways:

  • Submitted directly by a user: you send a REST API request to create a batch change request for entries and entry links.
  • Generated automatically by the enrichment agent: when an enrichment agent run generates metadata recommendations that require human review instead of auto-publishing, the agent creates a batch change request.

Governance workflows processing path

Knowledge Catalog tracks requests throughout their lifecycle using status values. The following table describes each status for single and batch change requests:

Status Single requests Batch metadata change requests
NEW Pending review. Only the author can edit the request, and only the author or a workflow administrator can delete it. Pending review. The author can edit user-submitted requests, reviewers can edit enrichment agent requests, and the author or a workflow administrator can delete the request.
APPLYING Not applicable. Approved and being applied in the background.
APPROVED Approved and applied. Approved, and at least one change in the batch succeeded. Any item-level errors are listed in the response.
FAILED Couldn't be applied. Updating the request resets its status to NEW for re-approval. None of the changes in the batch could be applied. Updating the request resets its status to NEW for re-approval.
REJECTED Declined by an approver. No changes were applied. Declined by an approver. No changes were applied.

When a request is manually deleted, its target resource is deleted, or it expires after 90 days, Knowledge Catalog permanently removes the request from storage. Subsequent queries for the request return a 404 NOT_FOUND error.

Governance workflows roles

Governance workflows roles include requesters, approvers, and workflow administrators. The following table describes the roles in detail:

Role Description
Requester Creates and submits requests, and can edit or delete their own requests while in the NEW state.
Approver Reviews, approves, or rejects requests. For batch metadata change requests generated by the enrichment agent, approvers can also edit the proposed batch changes before approving.
Workflow administrator Monitors compliance, configures workflow policies, and maintains the request backlog. Administrators can view audit trails across all request states and have administrative deletion permissions to remove requests in any state.

Limitations

What's next