About data domains

Data domains in Knowledge Catalog (formerly Dataplex Universal Catalog) provide a logical way to organize, manage, discover, and curate data resources within an enterprise, reflecting your business structure and ownership.

Key capabilities of data domains

Data domains decouple logical data organization from the underlying Google Cloud resource hierarchy of folders and projects. Data domains provide the following key capabilities:

  • Define a logical data organization hierarchy aligned with your business processes and logical groupings of data, decoupled from the Google Cloud resource hierarchy of folders and projects.
  • Act as the logical unit of ownership for decentralized domain teams, complementing data products.
  • Provide centralized control over who can discover resources and their metadata at scale.
  • Capture common context, such as usage guidance, governance standards, descriptions, and ownership information.
  • Use data domain to narrow search results down to a specific domain. For example, allow the users to search exclusively within the Marketing domain for faster, more relevant discovery.

Example use case

Consider a global retail enterprise with data assets scattered across departments such as Sales, Supply Chain, and Marketing. Logically similar data assets, such as sales-related tables or datasets, are scattered across multiple Google Cloud projects, making discovery and consistent governance difficult.

The following examples show how various users interact with data domains:

  • Data domain administrator

    Establishes a logical hierarchy, independent of underlying Google Cloud projects and delegates domain-level governance.

    • Creates top-level domains matching the organizational structure (such as Sales, Supply Chain, and Marketing) and configures subdomains (such as Online Sales and Store Transactions under Sales).
    • Assigns designated data domain owners for each domain (for example, assigning the Sales Lead as the owner of the Sales domain).

    For more information on how to create a data domain hierarchy and include resources, see Create data domains and Include resources in a data domain.

  • Data domain owner

    Defines the content of data domains under their ownership: includes data assets into the domains, defines domain-wide context, and establishes metadata policies over the domains to manage at scale discoverability of the domain's data assets and visibility of its context and metadata. For example, the Sales domain data owner performs the following actions:

    • Includes datasets, tables, and data products scattered across different projects into the Sales domain.
    • Defines domain-level aspects, such as data retention standards and cost centers. Defines who can discover the domain's assets and access their context and metadata by granting the required roles and permissions to the analysts@example.com group.

    For more information on how to manage data domains, see Manage data domains.

  • Data domain user

    Efficiently discovers relevant, trusted sales assets within a business context without sifting through unrelated enterprise data. For example, to obtain sales data for an upcoming marketing campaign, the data domain user does the following:

    • Explores the domain hierarchy to identify the Sales domain.
    • Scopes the search to the domain to find the relevant resources.
    • Inspects the resource metadata, schemas, and usage guidance to evaluate fitness for use.

    For more information on how to use data domains to find relevant data, see Use data domains.

Supported assets

You can use data domains for the following assets:

  • Projects
  • Data products
  • BigQuery datasets
  • BigQuery tables
  • Dataform repositories
  • Dataproc Metastore databases
  • Dataproc Metastore tables
  • Spanner databases
  • BigLake tables
  • AlloyDB for PostgreSQL instances
  • Gemini Enterprise Agent Platform datasets

Data domains and data products

Data domains and data products serve as complementary building blocks you can use to discover and access your data assets. A data domain provides a logical way to organize data assets based on business structure. A data product packages related assets, such as tables or views, into a curated bundle designed to solve specific business use cases.

Limitations

Search limitations

When you search for resources outside the domain context, for example when using a global search, the domain's discoverability permissions don't apply. You only see resources that you have access to in the underlying system, such as BigQuery.

Suppose a BigQuery dataset is included in a data domain. You have the Dataplex Data Domain Entry Reader role for the domain, but you don't have direct permission to view the dataset in BigQuery:

  • Searching within the domain: You see the dataset in your search results because the domain permissions apply.
  • Searching outside the domain: You don't see the dataset in your search results. In a general search, domain permissions don't apply, and you don't have direct access in BigQuery.

Authorization limitations

In the Preview launch stage, there is no continuous background IAM synchronization. Domain authorization is verified only when a binding is created. This means that if you revoke the domain principal's IAM role on a resource, that resource isn't automatically unbound or removed from the domain.

What's next