Author a Restricted Subscription Policy

Data owners who are not governors can write restricted subscription policies and data policies, which allow them to enforce policies on multiple data sources simultaneously, eliminating the need to write redundant local policies.

Unlike global policies, the application of these policies is restricted to the data sources owned by the users or groups specified in the policy and will change as users' ownerships change.

Write access policy requirements

• At least one of the following permissions is required to manage write policies:

  • CREATE_DATA_SOURCE Immuta permission (to create local write policies)

  • GOVERNANCE Immuta permission (to create local or global write policies)

  • MANAGE_POLICIES domain permission (to create global write policies)

• Databricks Unity Catalog, Snowflake, or Starburst (Trino) integration

• Snowflake table grants enabled (for Snowflake integrations)

Create a restricted subscription policy

1. Click the Policies in the left sidebar and select Subscription Policies.

2. Click Add Policy, complete the Enter Name field.

3. Select the access type:

   • Read Access: Control who can view the data source.

   • Write Access: Control who can view and modify data in the data source.

4. Select the level of access restriction you would like to apply to your data sources:

   • Allow anyone: Check the Require Manual Subscription checkbox to turn off automatic subscription. Enabling this feature will require users to manually subscribe to the data source if they meet the policy.

   • Allow anyone who asks (and is approved):

     1. Click Anyone or An individual selected by user from the first dropdown menu in the subscription policy builder.

        Note: If you choose An individual selected by user, when users request access to a data source they will be prompted to identify an approver with the permission specified in the policy and how they plan to use the data.

     2. Select the Owner (of the data source), USER_ADMIN, GOVERNANCE, or AUDIT permission from the subsequent dropdown menu.

        Note: You can add more than one approving party by selecting + Add Another Approver.

   • Allow users with specific groups/attributes:

     1. Choose the condition that will drive the policy: when user is a member of a group or possesses attribute. Note: To build more complex policies than the builder allows, follow the Advanced rules DSL policy guide.

     2. Use the subsequent dropdown to choose the group or attribute for your condition. You can add more than one condition by selecting + Add Another Condition. The dropdown menu in the subscription policy builder contains conjunctions for your policy. If you select or, only one of your conditions must apply to a user for them to see the data. If you select and, all of the conditions must apply.

     3. Check the Require Manual Subscription checkbox to turn off automatic subscription. Enabling this feature will require users to manually subscribe to the data source if they meet the policy.

     4. If you would like to make your data source visible in the list of all data sources in the UI to all users, click the Allow Data Source Discovery checkbox. Otherwise, this data source will not be discoverable by users who do not meet the criteria established in the policy.

     5. If you would like users to have the ability to request approval to the data source, even if they do not have the required attributes or traits, check the Request Approval to Access checkbox. This will require an approver with permissions to be set.

     6. Select how you want Immuta to merge multiple global subscription policies that apply to a single data source.

        • Always Required: Users must meet all the conditions outlined in each policy to get access (i.e., the conditions of the policies are combined with AND).

        • Share Responsibility: Users need to meet the condition of at least one policy that applies (i.e., the conditions of the policies are combined with OR).

        Note: To make this option selected by default, see the app settings page.

   • Allow individually selected users

5. From the Where should this policy be applied dropdown menu, select When selected by data owners, On all data sources, or On data sources. If you selected On data sources, finish the condition in one of the following ways:

   • tagged: Select this option and then search for tags in the subsequent dropdown menu.

   • with columns tagged: Select this option and then search for tags in the subsequent dropdown menu.

   • with column names spelled like: Select this option, and then enter a regex and choose a modifier in the subsequent fields.

   • in server: Select this option and then choose a server from the subsequent dropdown menu to apply the policy to data sources that share this connection string.

   • created between: Select this option and then choose a start date and an end date in the subsequent dropdown menus.

6. Beneath Whose Data Sources should this policy be restricted to, add users or groups to the policy restriction by typing in the text fields and selecting from the dropdown menus that appear.

7. Opt to complete the Enter Rationale for Policy (Optional) field.

8. Click Create Policy, and then click Activate Policy or Stage Policy.