[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"post:zero-trust-data-governance-and-quality":3},{"id":4,"slug":5,"title":6,"excerpt":7,"body":8,"tags":9,"read_minutes":14,"status":15,"published_at":16,"updated_at":17},"e07750cd-8d9a-4c35-8e9c-b63dcb59f367","zero-trust-data-governance-and-quality","Zero-Trust Data Governance: Automating Quality and Access in the Pipeline","Manual data quality checks and hand-managed permissions don't scale. Contracts enforced in the pipeline, observability that catches what tests can't, and RBAC as code with dbt.","\u003Cp>Zero-trust started as a network idea: verify every request. Applied to data platforms it means never assuming — not that upstream data is clean because it was clean yesterday, and not that access granted eighteen months ago is still appropriate today.\u003C\u002Fp>\u003Cp>The manual alternatives are the ones that fail. Broken pipelines silently feeding wrong numbers to dashboards cost real money and — worse — credibility, and the spreadsheet of who-can-see-what stopped reflecting reality two reorgs ago. The fix for both is the same: move the checks into the pipeline, as code.\u003C\u002Fp>\n\u003Ch2>Quality checks that block, not report\u003C\u002Fh2>\u003Cp>The zero-trust posture for quality is validation on every state change, with failures that stop the pipeline rather than emailing a report nobody reads. Great Expectations makes expectations executable — column X is never null, values of Y fall in this range, row counts stay within tolerance — and runs them as gates between pipeline stages, so bad data is quarantined before it propagates.\u003C\u002Fp>\u003Cp>Declared checks catch what you anticipated. Observability platforms like Monte Carlo cover the failures you didn't: they learn each table's normal freshness, volume, and distribution, then alert on anomaly — the feed that silently halved, the schema change nobody announced. Detecting an issue before a stakeholder does is the difference between a fix and an apology.\u003C\u002Fp>\n\u003Ch2>Access control as code, via dbt\u003C\u002Fh2>\u003Cp>Hand-run GRANT statements drift. Since dbt already knows every model it builds, it is the natural place to declare access: grants in model configs mean every dbt run reapplies the intended permissions — rebuilt tables never come up unprotected, and revoking access is a pull request with an audit trail, not a ticket.\u003C\u002Fp>\u003Cp>Structure the grants around roles, not people: analyst, finance, pii-reader. Tag models containing sensitive columns and let policies key off the tags, so a new PII table is protected by convention rather than by someone remembering.\u003C\u002Fp>\n\u003Ch2>Governance people can live with\u003C\u002Fh2>\u003Cp>Zero-trust fails when it becomes zero-productivity. The goal is defaults that are safe and paths that are fast: requesting access is a small PR, quality failures point at the exact expectation that broke, and the lineage graph shows who is affected before you ship a breaking change. Governance that helps engineers ship gets adopted; governance that only says no gets bypassed.\u003C\u002Fp>",[10,11,12,13],"Data Governance","Data Quality","dbt","RBAC",7,"published","2026-06-27T00:00:00Z","2026-08-27T16:17:41.412599Z"]