Before using Data Governance features, it's important to review the prerequisites and the steps required to enable governance across your organization’s data.
Prerequisties
Review the following steps before getting started.
- Familiarize yourself with data spaces, which define the boundaries for data visibility.
- To create specific, attribute-based policies, evaluate Data 360 standard permission sets and associated data governance permissions.
- (Optional) Enable Einstein to trigger automatic tagging. See Set Up Einstein Generative AI.
Overview of Steps
To grant granular access using access policies, assign data spaces through permission sets and create an access policy.
Note Assigning a data space
through a permission set doesn’t automatically give users access to the data.
To create and assign access policies, you must:
- Create tags and assign to objects and fields.
- Create custom permissions and add them to a custom permission set. You can’t add custom permissions to standard permission sets or their clones.
- Assign the permissions to the intended users.
- Create access policies to grant data access.
Control Models
Data 360 uses a combination of access control models to deliver granular, scalable, and policy-driven governance. Each mechanism serves a distinct purpose, and together they create a comprehensive security and governance framework.
| LAYER | function | what it controls |
|---|---|---|
| Data Spaces | Data visibility scope | Controls which data objects or records a user can interact with. It can be used to grant access to a set of objects but doesn’t support fine-grained or row-level control. |
| Role-based Access Control (RBAC) | Base access to features and setup | Navigation, admin tasks, configuration rights, and access assignment to specific objects within the dataspace. |
| Attribute-based Access Control (ABAC) | Policy-driven access based on context | Object-level, field-level, row-level, and masking rules |
- Data Cloud Governance Feature Availability by License
Salesforce offers a tiered licensing model for data governance within Data 360, enabling customers to scale from foundational governance to advanced, AI-driven controls. Understand which data governance features are available with which Data Cloud license. - Data 360 Governance Permissions
Review the permissions and permission sets required to effectively use data governance features in Data 360. - Assign Data Access
For data governance, assign access to Data 360 objects using either role or attribute-based policies, or maintain an Allow All policy. - Data Governance Considerations
Before you begin, it’s important to review supported features and considerations for using data governance features in Data 360.