Data Sharing Across Clouds

• Distinguish native listing/shares, external catalogs and cleanrooms
• Design sharing with respect to timeliness, cost and revocation
• Apply governance: lineage, restrictions and audit of who sees what

• No 3-hour CSV wrangling: consumers read the vendor's latest rows the moment they change.
• Governance stays with the producer: row/column via data policies, revocation at any time.
• Cleanrooms unlock collaborative analytics without a courtroom for the raw data.
• Reduced duplicate storage: you don't copy payloads you share read-only.

The library reads every edition live in a governed reading room; the publisher revokes a subscription, not a book. Data shares are reading-room licenses — live, revocable, and nothing leaves the publisher's hands.

• Lists/shares: producer publishes a catalog entry with permissions; reader's account binds it read-only.
• External catalogs: Iceberg/Delta catalogs attached across clouds let one engine query another's data (BigQuery on S3, Databricks UC on Snowflake).
• Cleanrooms: differential-privacy or SQL-limited analysis on combined datasets; raw rows never cross.
• Replication: for latency/cost, copy a subset with a schedule rather than live reads.
• Security: producer-side row/column policies, consumer-side contracts, full audit logs on both ends.

• A marketplaces shares inventory availability with 200 suppliers via BigQuery listings; suppliers query live demand without ever holding the file.
• Two health insurers run a cleanroom cohort study: dimension counts aggregate on their combined data; no patient rows cross systems.
• A financial vendor replicates a read-only copy of its curves daily across regions to keep cross-cloud consumers fast, then revokes access when the contract ends.

• Publish with row/column policies from day 1; retrofitting governance on shared data is painful.
• Prefer live reads for freshness; replicate only when latency/cost mandates it.
• Write the revoke-and-audit plan into the contract: what gets cut, what log survives.
• Test consumer expectations (freshness SLA, schema) against the share like any external contract.

• Emails with CSVs 'temporarily' that become the architecture for years.
• Sharing a full table when a materialized view with policies would do.
• Forgetting that external catalogs still bill cross-cloud egress for large scans.
• Cleanroom hubris: a wrong aggregation on shared data leaks individuals — validate before sharing.

• Consumer 'can't see data' → check binding activation, row/column policies and region replication lag, in that order.
• Slow shared queries → the scan runs in the producer's region; consider replicating a partition locally.
• Denied after a contract change → re-verify listing permissions on both the catalog and the underlying policies.
• Cleanroom anomaly → validate the join key space; common key leakage is the classic subtle bug.