# Setting Up Domains for Data Product Management

Typically, you would give a data product manager CREATE permission in a schema or database that they can use as their sandbox for generating new tables/views natively in their data platform using data engineering tools like dbt. Those newly generated tables/views (or even S3 objects) are what they can use as the [data sources for their data products](https://documentation.immuta.com/saas/request/access-data-products/reference-guide/data-products-and-assets#data-sources-and-columns).

You must get these new data objects from the data platform as registered in Immuta and assigned to a domain so that they can be published in data products:

* Immuta automatically registers objects through periodic polling (24 hours by default) to detect changes in the data platform and represent those changes in Immuta, as data sources. These checks can also be [manually triggered](https://documentation.immuta.com/saas/developer-guides/api-intro/immuta-v1-api/data-sources#trigger-schema-monitoring-jobs).
* Once the objects are registered in Immuta as data sources, they are assigned to a domain one of two ways:
  * **Manually**: The data source is assigned to the domain through the [Govern app](https://documentation.immuta.com/saas/configuration/configure-domains#assign-data-sources-to-a-domain) (or [API](https://documentation.immuta.com/saas/developer-guides/api-intro/immuta-v1-api/domains-api#post-collection-collectionid-datasources)) by a user with `GOVERNANCE` permission.
  * **Dynamically (recommended)**: The data source is automatically assigned to the domain based on if it has a specific tag.

    Tags can be applied directly to the tables/views in the data platform (Snowflake, Databricks Unity Catalog, and AWS Lake Formation only), imported from a [supported external catalog](https://documentation.immuta.com/saas/configuration/tags/catalogs/reference-guides/pre-configuration), or applied through the Immuta UI.

See the examples in the tabs below to understand your options when dynamically assigning data sources to domains for data products.

{% tabs %}
{% tab title="Connections tags" %}
**Requirement**: [Data sources from a connection](https://documentation.immuta.com/saas/configuration/integrations/data-and-integrations/registering-a-connection/reference-guides/connections-overview)

1. An administrator of the data platform GRANTs CREATE permission to the hypothetical schema `business.hr-data-products` to the data engineers.
2. User with `GOVERNANCE` permission [creates the domain](https://documentation.immuta.com/saas/configuration/configure-domains#create-a-domain) `HR Domain` and selects [dynamic assignment](https://documentation.immuta.com/saas/configuration/domains#domain-data-sources) based on the tag `Immuta Connections . Snowflake . business . hr-data-products`.
3. User with `USER_ADMIN` permission [provides the data engineers with permission](https://documentation.immuta.com/saas/configuration/configure-domains#assign-domain-permissions) `Manage Data Products` in that domain.
4. Data engineer creates 6 new tables in the schema `business.hr-data-products` and wants to now have them available as data sources for a data product.
5. When Immuta registers those objects, it will include the connection tag to represent the schema and database.
   1. If Immuta hasn't yet found those new tables through periodic polling, the data engineer executes [object sync](https://documentation.immuta.com/saas/developer-guides/api-intro/connections-api/how-to-guides/manage-a-connection#post-data-crawl-objectpath) over the Immuta API so that Immuta will find them.
6. Those 6 tables will appear as data sources within the domain and are now available for data products.
   {% endtab %}

{% tab title="Data platform tags" %}
**Requirement**: Snowflake, Databricks Unity Catalog, or AWS Lake Formation data sources

1. An administrator of the data platform GRANTs CREATE permission to the hypothetical schema `business.hr-data-products` to the data engineers. This administrator also creates the tag `HR Domain` in the data platform to tag the tables.
2. User with the `APPLICATION_ADMIN` permission configures [Snowflake](https://documentation.immuta.com/saas/integrations/snowflake/how-to-guides/enterprise#opt-to-enable-snowflake-tag-ingestion), [Databricks Unity Catalog](https://documentation.immuta.com/saas/integrations/databricks/databricks-unity-catalog/how-to-guides/connect-unity-catalog#opt-to-enable-databricks-unity-catalog-tag-ingestion), or [AWS Lake Formation](https://documentation.immuta.com/saas/configuration/integrations/aws-lake-formation/register-an-aws-lake-formation-connection) to ingest tags.
3. User with `GOVERNANCE` permission [creates the domain](https://documentation.immuta.com/saas/configuration/configure-domains#create-a-domain) `HR Domain` and selects [dynamic assignment](https://documentation.immuta.com/saas/configuration/domains#domain-data-sources) based on the tag `HR Domain`.
4. User with `USER_ADMIN` permission [provides the data engineers with permission](https://documentation.immuta.com/saas/configuration/configure-domains#assign-domain-permissions) `Manage Data Products` in that domain.
5. Data engineer creates 6 new tables in the schema `business.hr-data-products` and wants to now have them available as data sources for a data product.
6. Data engineer tags those data sources with the `HR Domain` tag directly in the data platform. When Immuta registers those objects, it will include the data platform tag(s).
   1. If Immuta hasn't yet found those new tables through periodic polling, the data engineer executes [schema monitoring](https://documentation.immuta.com/saas/developer-guides/api-intro/immuta-v1-api/data-sources#trigger-schema-monitoring-jobs) over the Immuta API so that Immuta will find them.
7. Those 6 tables will appear as data sources within the domain and are now available for data products.
   {% endtab %}

{% tab title="Immuta tags" %}

1. An administrator of the data platform GRANTs CREATE permission to the hypothetical schema `business.hr-data-products` to the data engineers. This administrator also creates the tag `HR Domain` in the data platform to tag the tables.
2. User with `GOVERNANCE` permission [creates the new tag](https://documentation.immuta.com/saas/tags/manage-tags/how-to-guides/managing-tags#create-tags) `HR Domain`.
3. User with `GOVERNANCE` permission [creates the domain](https://documentation.immuta.com/saas/configuration/configure-domains#create-a-domain) `HR Domain` and selects [dynamic assignment](https://documentation.immuta.com/saas/configuration/domains#domain-data-sources) based on the tag `HR Domain`.
4. User with `GOVERNANCE` permission [configures the data engineers to be data owners of all the tables in the schema `business.hr-data-products` (includes future tables)](https://documentation.immuta.com/saas/integrations/data-and-integrations/registering-a-connection/how-to-guides/manage-connection-settings#assign-domain-permissions-2). Being the data owner allows you to manage tags on the tables in the Govern app.
5. Data engineer creates 6 new tables in the schema `business.hr-data-products` and wants to now have them available as data sources for a data product.
   1. If Immuta hasn't yet found those new tables through periodic polling, the data engineer executes [schema monitoring](https://documentation.immuta.com/saas/developer-guides/api-intro/immuta-v1-api/data-sources#trigger-schema-monitoring-jobs) over the Immuta API so that Immuta will find them.
6. Data engineer tags those data sources with the `HR Domain` tag from within the Govern app (or with the API).
7. Those 6 tables will appear as data sources within the domain and are now available for data products.
   {% endtab %}
   {% endtabs %}

As you can see in all the examples, the `GOVERNANCE` user was able to still limit what data sources land in the `HR Domain` by limiting the scope of power where the data engineer could apply tags. In the first two examples, they are limited to applying tags only in the schema where they have CREATE permission in the data platform. In the second example, they are limited to where they can apply tags by where they were made data owners.


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://documentation.immuta.com/saas/configuration/domains/setting-up-domains-for-marketplace.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.