> For the complete documentation index, see [llms.txt](https://documentation.immuta.com/saas/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://documentation.immuta.com/saas/govern/getting-started-with-secure/compliantly-open-more-sensitive-data-for-ml-and-analytics/open-managing-data-metadata.md). # Managing Data Metadata This guide describes how to organize and manage data metadata, which is used by Immuta to identify data targeted by policy:
Once your external data catalog tags, identification tags, and classification tags are applied to your data sources, you can use those tags to author policies to protect your data.
## Prerequisites [Your schema metadata is registered](/saas/configuration/integrations/data-and-integrations/registering-metadata.md) ## Enriching your data metadata with tags To manage data metadata with this particular use case, you should use the [ABAC method as described in the Governance use cases introduction](/saas/govern/getting-started-with-secure.md#is-access-determined-by-many-variables). This is because you must know the contents and sensitivity of **every** column in your data ecosystem to follow this use case. With orchestrated RBAC, you tag your columns with access logic baked in. ABAC means you tag your columns with facts: what is in the column. It is feasible to do the latter, extremely hard to do the former, especially in an data ecosystem with constant change. Understanding that, read the [Managing data metadata](/saas/govern/getting-started-with-secure/automate-data-access-control-decisions/managing-data-metadata.md) guide. However, there are some considerations specific to this use case with regard to data metadata. ## Automated data tagging Automated data tagging with [identification](/saas/configuration/tags/data-classification.md) is recommended with this use case because it significantly reduces the manual effort involved in classifying and managing data. It ensures that data is consistently and accurately tagged, which is crucial for implementing effective data policies. Moreover, it allows for real-time tagging of data, ensuring that new or updated data is immediately protected by the appropriate policies. This is critical when all columns need to be considered for policy immediately, which is the case with this use case. ## Schema monitoring enabled While not directly related to data tagging, [schema monitoring](/saas/configuration/integrations/data-and-integrations/registering-metadata/schema-monitoring.md) is a feature in Immuta that allows organizations to keep track of changes in their data environments. When enabled, Immuta actively monitors the data platform to find when new tables or columns are created or deleted. It then automatically registers or disables these tables in Immuta and updates the tags. This feature ensures that any global policies set in Immuta are applied to these newly created or updated data sources. It is assumed you are using schema monitoring when also using identification. Without this feature, data will remain in [data downtime](/saas/govern/secure-your-data/authoring-policies-in-secure/dbt-transform-workflow.md#step-4-force-data-downtime) while waiting for the policies to update. ## Data tags are facts As discussed above, with ABAC your data tags need to be facts. Otherwise, a human must be involved to bake access logic into your tags. As an example, it's easy for identification to find an address, but it's harder for a human to decide if that address should be sensitive and who should have access to it - all defined with a single tag - for every column! ## Next steps
LearnRead these guides to learn more about using Immuta to mask sensitive data.
  1. Compliantly open more sensitive data for ML and analytics: Review this use case to understand how to mask or open up sensitive data to certain users for machine learning and analytics while remaining compliant.
  2. Managing user metadata: This guide explains how meaningful user metadata is critical to building scalable policy and understanding the considerations around how and what to capture.
  3. Author policy: This guide describes how to define your global data policy logic.
ImplementFollow these guides to start using Immuta to mask sensitive data.
  1. Manage user metadata. Tag your users with attributes and groups that are meaningful for Immuta global policies.
  2. Manage data metadata. Tag your columns with tags that are meaningful.
  3. Author policy. Define your global data policy logic.
  4. Optionally test and deploy policy.
--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://documentation.immuta.com/saas/govern/getting-started-with-secure/compliantly-open-more-sensitive-data-for-ml-and-analytics/open-managing-data-metadata.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.