Data Governor Introduction to Immuta
Audience: Data Governors
Content Summary: This section introduces Governors to the Immuta platform and supports them in enforcing existing laws and policies through Immuta, allowing Governors to make sure their organization is using its data compliantly.
This page introduces Governors to Immuta as a whole, while the rest of this Data Governor section includes conceptual pages, which define major features and terms, and tutorial pages, which provide step-by-step instructions for managing tags, policies, reports, and projects.
Immuta: A Single Access Point
The Immuta platform solves two of the largest issues facing data-driven organizations: access and governance. In large organizations, it can be difficult, if not impossible, for data scientists to access all the data they need. Once they do get access, it’s often difficult to make sure they use the data in ways that are compliant.
The Immuta platform is meant to solve both problems by providing a single, unified access point for data across an organization and ensuring that all restrictions placed on data are dynamically enforced through the platform. Because the Immuta platform unifies access to data, governing that access is of primary concern. Implemented properly, the Immuta platform can ensure that only the right people see the right data under the right conditions.
Immuta User Roles
User roles in Immuta are fluid and interdependent, and understanding these different roles is essential to effectively sharing, analyzing, and protecting data and maintaining compliance.
Data Owners: In order for data to be available in the Immuta platform, a Data Owner — the individual or team responsible for the data — needs to connect their data to Immuta. Once data is connected to Immuta, that data is called a data source. In the process of creating a data source, Data Owners are able to set policies on their data source that restrict which users can access it, which rows within the data a user can access, and which columns within the data source are visible or masked. Data Owners can also decide whether to make their data source public, which makes it available for discovery to all users in the Immuta Web UI, or made private, which means only the Data Owner and its assigned subscribers know it exists.
Data Users: Data Users consume the data that’s been made available through Immuta. Data Users can browse the Immuta Web UI seeking access to data and easily connect their third-party data science tools to Immuta.
Project Owners: These users can create their own project to restrict how their data will be utilized using purpose-based restrictions or to efficiently organize their data sources.
Governors: Governors set Global Policies within Immuta, meaning they can restrict the ways that data is used within Immuta across multiple projects and data sources. Governors can also set purpose-based usage restrictions on projects, which can help limit the ways that data is used within Immuta. By default, Governors can subscribe to data sources; however, this setting can be disabled in the Immuta Configuration, removing the Governor's ability to create or subscribe to data sources. Additionally, users can be a Governor and Admin simultaneously by default, but this setting can also be changed in the Configuration Builder, rendering the Governor and Admin roles mutually exclusive.
Application Admins: Application Admins manage manage the configuration of Immuta for their organization. These users can configure Immuta to use external identity managers and catalogs, enable or disable data handlers, adjust email and cache settings, generate system API keys, and manage various other advanced settings.
User Admins: Another type of System Administrator is the User Admin, who is able to manage the permissions, authorizations, and groups that attach to each user. Permissions are only managed locally within Immuta, but groups and authorizations can be managed locally or derived from user management frameworks such as LDAP or Active Directory that are external to Immuta. By default, Admins can subscribe to data sources; however, this setting can be disabled in the Immuta Configuration, removing the Admin's ability to create or subscribe to data sources. Additionally, users can be an Admin and Governor simultaneously by default, but this setting can also be changed in the Configuration Builder, rendering the Admin and Governor roles mutually exclusive.
The Governance page allows Data Governors to run Immuta Reports; manage Global Policies, tags, and purposes; and configure project settings. Each of the tabs on the Governance page is described below.
This tab contains a list of all activity associated with the Governor, data sources, and Global and Local Policies.
Governors can build reports to analyze how data is being used and accessed across Immuta using this Report Builder. Reports can be based on users, groups, projects, data sources, tags, purposes, policies, and connections within Immuta.
For detailed information on how to run reports, please see the Reports section of the Governor Guide.
Global Policies Tab
Global Policies limit who can access data sources across Immuta. Governors build Global Policies using either the Subscription Policy Builder or the Data Policy Builder. When Governors indicate where policies should apply, the policies will automatically be enforced on the relevant data sources. Otherwise, Data Owners can select the Global Policies by name and apply them to their data sources.
Governors can create tags or import external tags that Data Owners can then apply to projects, data sources, and data source columns.
Governors manage purposes for data use across Immuta. After creating a purpose, Governors can customize acknowledgement statements that users must agree to before accessing a project or data source. Project owners also have the ability to create purposes, and these purposes will populate in a list in the left panel of the Purposes tab on the Governance page as well.
The Settings window allows Governors to change settings for the use of purposes within projects. If a setting is changed that affects all users, each project owner will receive notifications for any activities that are out of compliance with the changes.
The Default Acknowledgement window allows Governors to customize the default acknowledgement statement that all members of projects have to affirm. Additionally, these statements can be customized for each project in the Purposes tab.