Governance: policies, access, and compliance

What it is

Governance is the “who can do what with this data?” layer of a governed data product. It covers who can read or write, how sensitive fields are classified, and who must approve a change. Without governance, a product might be technically consumable but unsafe to use. In Loxtep, a governed data product can carry governance metadata — tags, role-based access, and approvals — so the context we deliver is auditable.

How it’s made

Governance for a governed data product is defined and enforced as follows:

• Role-based access. You define who can access the asset by role: read, or read and write. Policies are stored as rules (e.g. “role:support can read orders”) and evaluated when the asset is used. Denied requests are logged.
• Governance tags and metadata. Sensitive fields (PII, financials) can be tagged on the asset or in the lexicon — for example “email is personal data” or “revenue is internal.” Those tags travel with the product so owners and reviewers can see classification.
• Approvals. Changes to a governed data product — its definition or who can access it — can require an approval so a reviewer signs off before the change takes effect.
• Compliance metadata. An asset (and optionally a field) can carry classification tags such as “personal data” or “SOX relevant.” That metadata records how the product is classified and supports reporting and audit.

Example governance block for an Orders context asset:

{
  "governance": {
    "access": [
      { "role": "support", "action": "read" },
      { "role": "finance", "action": "read" },
      { "role": "admin", "action": "read,write" }
    ],
    "tags": [
      { "field": "customer.email", "classification": "personal_data" },
      { "field": "order.revenue", "classification": "internal" }
    ],
    "approvals": { "required_for": ["definition_change", "access_change"] },
    "compliance": ["personal_data", "SOX-relevant"]
  }
}

In Loxtep, governance tags, role-based access, and approvals are recorded when you define or update a governed data product. Role-based access is what the platform enforces; tags and approvals are the metadata owners and reviewers use to keep that access intentional.

Why it matters for governed data products and AI

Context that isn’t governed is a liability. By making governance a first-class part of the governed data product, you keep access role-based, classification visible, and changes reviewable. For AI, governance determines what the model is allowed to see — so you get useful context with an audit trail. In Loxtep, a governed data product can include governance metadata so the context we deliver is traceable.