DATA GOVERNANCE & CATALOG
Make Data Ownership and Lineage Actionable.
Turn disconnected metadata into a discoverable, governed information landscape with practical ownership and stewardship processes. Bassirah combines DataHub Core implementation with the operating model, integrations and access design that make governance work day to day.
DataHub Core · dbt Core / dbt OSS · Trino OSS or Starburst · ClickHouse · enterprise IAM
THE CHALLENGE
Governance Fails When Metadata Lives in People's Heads
As data platforms multiply, knowledge about what data exists, what it means and who is responsible for it gets scattered across spreadsheets, wikis and individual experts. Governance programmes often produce policies and committees, but analysts still cannot find trusted data, and auditors still struggle to trace a reported figure back to its source.
- Analysts spend time searching for data and asking colleagues which table is correct.
- Business terms such as “active customer” or “net revenue” have several competing definitions.
- No one can quickly say who owns a dataset or approves changes to it.
- Lineage from source to report is reconstructed manually for each audit or incident.
- Catalog tools are installed but go stale because nothing keeps metadata current.
A catalog is only valuable when ownership, definitions and lineage are kept current by process and automation.
OUTCOMES
Discoverable, Owned and Traceable Data
Enterprise discovery
One searchable catalog of datasets, dashboards, pipelines and models across your platforms.
Clear ownership
Named owners and stewards for in-scope data assets, with a defined process for changes and questions.
Shared business language
A business glossary linked to the physical datasets that implement each term.
Lineage you can use
Automated lineage from sources through transformations to reports, for impact analysis and audit support.
REFERENCE ARCHITECTURE
How the Governance Layer Connects to Your Platforms
DataHub Core acts as the metadata and governance control plane. It collects metadata through validated connectors; it does not sit in the data path or replace platform security.
- Inventory and prioritizeIdentify in-scope sources, data domains and critical reports, and agree which assets need owners, definitions and lineage first.
- Ingest metadataDataHub Core ingests schemas, usage and lineage from databases, query engines (Trino OSS or Starburst, ClickHouse), dbt projects and BI tools through supported ingestion connectors, on an agreed schedule.
- Enrich with business contextOwners, stewards, domains, glossary terms, classifications and documentation are added through stewardship workflows, not one-off data entry.
- Connect lineagedbt model lineage and query-engine lineage are combined to show dependencies from source tables to business-ready models and reports.
- Align with enforcementClassifications and ownership in DataHub inform access policies, which are enforced in the query engines, databases, object storage and IAM systems that hold the data.
- Operate and measureIngestion health, metadata coverage and stewardship activity are monitored, and the platform itself is secured, backed up and upgraded under a documented runbook.
TECHNOLOGY ROLES
Each Component Has One Clear Job
| Component | Role in this solution | Route | Qualification |
|---|---|---|---|
| DataHub Core | Metadata catalog, ownership, glossary, classification and lineage | Independent Bassirah open-source engineering | Not a policy enforcement point; connector coverage confirmed per source and version |
| dbt Core / dbt OSS | Source of model definitions, tests, documentation and transformation lineage | Independent open-source engineering | Lineage ingestion validated for the dbt release and adapter in use |
| Trino OSS or Starburst | Query engine metadata and, where configured, access policy enforcement | OSS engineering or strategic partner | Alternatives for the same role; enforcement features depend on version and edition |
| ClickHouse | Analytical store metadata; enforces its own users, roles and grants | Strategic partner or OSS engineering | Metadata ingestion and permission model validated per deployment |
| Databases and object storage | Source schemas; enforce their own access controls | Customer platforms | Enforcement remains with each platform |
| Enterprise IAM / SSO | Identity, groups and authentication for DataHub and data platforms | Customer platform | Group mapping and role design agreed with security owners |
See DataHub Core, dbt, Trino OSS, Starburst and ClickHouse.
CLEAR BOUNDARIES
A Catalog Informs Policy. Platforms Enforce It.
DataHub Core provides metadata discovery, lineage and governance workflows. Actual data authorization is enforced in the connected query engines, databases and security systems. Every Bassirah governance design states which system is the policy decision point and which is the enforcement point for each type of rule, so there are no gaps between what the catalog says and what users can actually access.
| Responsibility | Where it lives |
|---|---|
| What data exists, what it means, who owns it | DataHub Core |
| How data was derived | DataHub Core lineage, fed by dbt and query engines |
| Who may query a table, column or row | Query engine, database or storage access controls |
| Who a user is and which groups they belong to | Enterprise IAM / SSO |
| Evidence of who accessed what | Platform audit logs, integrated with enterprise monitoring |
Independent open-source support and compliance.
DataHub Core and dbt services are independent Bassirah engineering and do not imply affiliation with, endorsement by, or upstream support from those projects or their maintainers. A governance platform supports, but does not by itself establish, regulatory compliance. Designs are aligned to your regulatory and data-residency requirements as assessed with your legal and security teams.
Unsure where access is really enforced today?
We will map your catalog, policies and enforcement points.
USE CASES
Where Data Governance & Catalog Delivers Value
Enterprise catalog
Give every analyst and engineer one place to search for data, see its owner and understand how it should be used.
Data product discovery
Publish domain data products with owners, documentation, quality signals and consumers, so teams reuse rather than rebuild.
Regulatory traceability and reporting lineage
Trace regulatory and management reports back through transformations to their sources, supporting audit and impact analysis.
DESIGN & ACCEPTANCE CONTROLS
What We Define, and How We Prove It
| Control | What we define | Acceptance evidence |
|---|---|---|
| Governance ownership | Roles (owner, steward, custodian), responsibilities and escalation route per domain | Ownership assigned for agreed in-scope assets; RACI signed off |
| Classification | Sensitivity and data-category scheme, and how classifications are applied and reviewed | Classification applied to in-scope assets; review workflow exercised |
| Glossary | Priority business terms, definitions, approvers and links to physical assets | Approved glossary terms linked to the datasets that implement them |
| Access model | Access to the catalog itself, plus mapping from classifications to enforcement points | Access tests for catalog roles; documented enforcement point per rule type |
| Lineage quality | Which lineage is automated, which is manual, and expected coverage | Lineage verified end to end for selected critical reports |
| Acceptance metrics | Coverage, freshness and usage indicators agreed with the governance lead | Baseline and post-implementation metadata coverage report |
| Platform operations | DataHub deployment, ingestion schedules, backup, upgrade and monitoring | Runbook tested, including restore and connector failure handling |
WHY BASSIRAH
Governance That Engineers and Business Teams Both Use
Bassirah brings discovery, architecture decisions, implementation services, integration validation, knowledge transfer and operational support into one managed engagement. Technology selection follows measurable workload and compliance requirements.
- DataHub Core deployment, security hardening and connector configuration for your platforms.
- Ownership, stewardship and glossary operating models sized for adoption, not paperwork.
- Lineage that combines dbt, query engines and BI, validated on critical reports.
- Explicit mapping from catalog classifications to the systems that enforce access.
- Integration with lakehouse, warehouse and real-time analytics architectures we deliver.
- Steward and administrator enablement, with optional managed operations of the catalog.
ENGAGEMENT PATH
How a Data Governance Engagement Runs
- Governance assessmentCurrent metadata, ownership, glossary, lineage and access practices against your objectives.
- Operating model & designRoles, workflows, classification scheme, DataHub architecture and enforcement mapping.
- Pilot domainDataHub Core deployed for one domain with owners, glossary and lineage proven end to end.
- Scale outFurther domains and connectors onboarded, with coverage metrics tracked.
- Enable & operateSteward and admin training, then contracted managed operations if required.
Data Governance & Catalog FAQ
Can DataHub enforce data access policies?
DataHub Core provides metadata discovery, lineage and governance workflows, but actual data authorization is generally enforced in the connected query engines, databases and security systems. Our designs define which system is the policy decision point and which is the enforcement point.
Which systems can DataHub collect metadata from?
DataHub offers ingestion connectors for many databases, query engines, transformation tools and BI platforms. Coverage and depth vary by connector and version, so we confirm support for each of your sources during design.
How do you keep the catalog from going stale?
By automating metadata ingestion on a schedule, assigning owners and stewards with clear responsibilities, and tracking coverage and freshness metrics that the governance lead reviews regularly.
Does implementing a catalog make us compliant?
No. A catalog supports compliance work by improving visibility, ownership and traceability, but compliance depends on your policies, controls and evidence. We align designs to requirements assessed with your legal and security teams.
Do we need dbt to get lineage?
No, but it helps. DataHub can capture lineage from several sources. When transformations are built in dbt, model-level lineage and documentation become more complete and consistent. See Analytics Engineering & Transformation →
Related Pages
Data Quality & MDM for DataHub
Bassirah’s governed DataHub catalogue with quality gates and master data management.
GenBI (Chat With Your Data)
Bassirah’s conversational analytics in Arabic and English, with a trust label on every answer.
Make Ownership and Lineage Work for Your Teams
Tell us about your platforms, priority domains and governance goals. We will propose an operating model and a pilot scope.