Data Warehousing
Intermediate 13 min read Data Warehousing

Warehouse Governance

Self-service, with guardrails

Governance is the operating discipline of the warehouse: access control, lineage, fresh-ownership, data-quality expectations, and cost ownership — moving from 'anyone can query anything' to controlled self-service.

governanceaccess controllineageownershipcostfreshness
Prerequisites: Warehouse Architecture Semantic Layer
Before we start

What you will learn

  • Define the governance levers: access, lineage, ownership, quality, cost
  • Delegate read access while preserving security
  • Turn chaos into controlled self-service without becoming a bottleneck
Introduction

What is this?

Warehouse governance is the discipline that keeps a growing warehouse trustworthy: role-based access (who can read what), lineage (where a model came from), ownership (who is accountable for freshness/correctness), quality gates (tests in CI), and cost attribution (who pays for scans). Done well it enables self-service rather than blocking it.

Motivation

Why do you need it?

  • A warehouse without governance becomes a pile of unowned, un-fresh tables nobody trusts.
  • Cost blowups and PII leaks are governance failures, not engineering failures.
  • Good governance is the difference between 'the data team is a bottleneck' and 'analysts self-serve safely'.
Think about it

Mental model

Imagine

A library with a card catalog and lending rules

Think of

Warehouse governance

Anyone may browse (self-service), but the catalog records provenance (lineage), a librarian sets lending rules (access), and each shelf has an owner keeping it current (ownership) with a budget for the room (cost).

Mechanics

How it works

  • Roles split: reader, modeler, admin — least privilege by default, granular by table/schema.
  • Lineage tracks table -> model -> dashboard so changes and incidents route correctly.
  • Ownership: each table has a responsible team; freshness SLA, tests, and triage go to them.
  • Quality gates in CI (row counts, uniqueness, schema checks) fail a deploy before trust decays.
  • Cost attribution: scans billed per team/dashboard, so expensive queries become visible and fixable.

The governance loop.

Access
Lineage
Ownership
Quality gates
Cost & trust
Hands-on

Examples

A governance-y schema contract

A governance-y schema contract
-- least-privilege read for a team
CREATE ROLE analytics_reader;
GRANT SELECT ON schema.mart_sales TO analytics_reader;
GRANT USAGE ON SCHEMA analytics TO analytics_reader;
 
-- lineage/ownership living in the model metadata
ALTER TABLE analytics.fct_sales SET COMMENT = 'owned by: finance-data | sla: 1h | fresh: hourly';

Read-only roles, plus ownership/freshness metadata standing next to the table itself.

Real world

In production

  • A finance team grants analysts SELECT on marts while the modeling team alone writes to core.
  • A lineage tool page flags 'schema change in dim_product' and pings every dashboard owner before it breaks.
  • A cost report ranks the most expensive queries by team, and a monthly cleanup retires the cold tables.
Guidelines

Best practices

  • Least privilege by default; time-boxed standing roles beat ad-hoc grants.
  • Make lineage automatic from the pipeline, not a wiki half-updated.
  • Each table gets an owner, SLAs, and a data-quality test set in CI.
  • Charge cost to teams so governance becomes an incentive, not a lecture.
Watch out

Common mistakes

  • Giving everyone discovery-select on everything, leaking PII and freezing the optimizer with impossible joins.
  • No lineage, so 'the number changed' becomes an archaeology dig.
  • Testing quality only at the dashboard, where damage is already visible.
When things break

Debugging tips

  • When a table's freshness breaks, the owning team (from lineage metadata) is the right on-call.
  • Governance dashboards surface unowned tables; a table with no owner is the first failure signal.
  • Permission failures are usually role gaps: distinguish 'no grant' from a genuinely un-approved query.
Interviews

Interview checkpoint

Test yourself

Quick quiz

0/2
1

The point of governance is to eliminate analyst self-service.

2

A schema-comment 'owned by: finance-data | sla: 1h' is an example of which lever?

Go deeper

Official documentation

Snowflake access control
docs
BigQuery access control
docs
dbt governance features
docs