Four-eyes principle -- with workflows?
Hi.
We’re looking to implement the four-eyes principle on our metadata. In general, it seems that Data Stewards (business or technical, depending) generally have full write access to the areas in Collibra where they are stewards. Our challenge is that as a bank, our auditors are asking for more ‘review’ of the changes – especially on changes to approved assets.
It seems really harsh to just remove all the permissions and put everything under a workflow. And worse, because that workflow might require us to move things between domains to change the write-accesses…
Is anyone else here doing four-eyes? What approach did you take?
dianereynolds
Posted 5 years ago · Edited 1 year ago·Last reply 5 years ago
10 comments
aaronballinger
·5 years ago · EditedA user without any permissions can trigger an approval workflow but a user/role with an author license has to approve it correct?
arthurburkhardt
·5 years ago · EditedNo, any user can perform any action through workflows (provided you have configured it as such), regardless of consumer or author license.
noor
·5 years ago · Edited@arthur.burkhardt - I notice in another discussion “Author Vs Consumer License” - a mention that users who are supposed to approve tasks allocated by Workflows need an author license?
arthurburkhardt
·5 years ago · EditedYes, that’s what I read also, not sure what is the status on that.
Overall, I find the author/consumer model a bit clunky and outdated. It was working well at a time when data stewardship was a job for a little group of people, but modern governance paradigms invite all data citizen to take part in data governance. The diversity of data profiles makes it hard to implement.
arthurburkhardt
·5 years ago · EditedAhahaha, Thanks @noor.shaik for tagging me.
@diane.reynolds.seb.se
Collibra has a permission scheme for users to DIRECTLY update information into Collibra.
But workflows do not abide by that permission scheme.
So, a user WITHOUT any write permission can trigger a workflow to create/update/delete an asset.
Here’s an example of an out-of-the-box collibra workflow, showing the interactions between any user (Start User), an SME, a Stakeholder and a data steward.
You can find more information in the Collibra documentation, in the workflows walk-throughs: Workflow Documentation - Collibra - Developer
Collibra is often praised for the powerful workflow engine that allows to easily implement the process you are describing. Just be aware that you still need developers to implement it.
dianereynolds
OP5 years ago · EditedThanks Arthur! So, does this workflow all happen in the same community (where the data asset already lives)? Is there a different ‘status’ for the data asset as it goes through the process? Which version do ‘ordinary’ users see? The initial one, or the suggested revision?
arthurburkhardt
·5 years ago · EditedIf you want to have two versions of the asset (i.e. the “approved” version, and the “proposed” version), you can have a look at this workflow: Snapshot Manager - Collibra Marketplace. It allows to manage multiple versions of an asset.
Ultimately, it would probably be very valuable for you to have a discussion with the coaching team or the Collibra professional services, as they would be able to go deep with you into your requirements and offer best-of-class solutions to meet your needs.
dianereynolds
OP5 years ago · EditedYes, that’s what we’d like to have - Data Stewards who make a change, then the Owner to approve it. (or maybe SMEs make a change the the Data Steward approves it… but not both!) The challenge we have is in setting this up in the system… it seems from a security perspective that users either have write access or they don’t…
In your situation, do you have a small workflow that gives the data stewards edit rights and then sends on to the data owners? Do you move the assets into different communities where there are difference access rights? We’ve been exploring the workflow as an option… but still find the community movements of assets confusing! If not, then how do you ensure the data quality?
noor
·5 years ago · EditedHi Diane, there are 2 types of licensed users mainly in Collibra : Authors & Consumers.
Data Stewards are usually authors. So, granting them EDIT rights is usually the right way. But, let other SMEs here like @arthur.burkhardt comment.
noor
·5 years ago · EditedHi Diane,
Can you please elaborate on what it means “more review of the changes”?
Do the auditors want more stakeholders to be involved in the workflow process?
Authorized stewards doing the changes, and owners approving them is a typical process as far as I know.