On 27/09/2016 21:19, Suma Shivaprasad wrote:
> 1. Classification - that are locked down and that have a classification
> scheme to group together a set of classification concepts
> 2. Annotation - that are free form and are not locked down
>
> So Traits could be renamed as Annotation and Classification is a
> specialization of an Annotation with an additional classification scheme
> associated with it.
One additional consideration once we've decided is to see if we can also
persuade the Apache Ranger team to adopt the same terminology
The use of classifications to control access to data, ie to perform
governance actions including audit, check, permit/deny, mask, filter
etc, is very important to get the simplicity and scalability we need in
governing data.
Today we refer to "tags" in atlas and ranger -- I wonder if ranger
should then use "classification" too (though I'm also aware there are
tag sources other than atlas, such as kafka)
In the ranger atlas tagsync process we pull all entities with traits -
and so need to decide whether to
- allow governance policies to refer to any traits (in proposal above
annotation)
- allow them to apply to classification only.
I think in most cases it is classification that matters, plus the volume
of traits could get massive, though any context can be relevant for
making a policy decision. Perhaps we can differentiate on the properties
of the trait as to whether to sync, and how they get used when composing
a ranger rule. In fact that's another point, ranger uses the word
"policy" when in my opinion it's a rule. A policy is imo logical ie
"prevent access to PII data for normal users" and should be represented
in Atlas whilst the rule is technology-specific, an implementation of
the policy. This relationship needs recording too.
Do we have any of the atlas team also closely involved with ranger? I'm
also happy to raise the issue over there, after we've decided how to
best model. I'm looking more at that over here and how we should model
these relationships.
Nigel.
---
Nigel Jones - Software Architect - IBM Analytics Group
IBM United Kingdom Limited / Registered in England and Wales with number
741598 / Registered office: PO Box 41, North Harbour, Portsmouth, Hants.
PO6 3AU
