Use sandboxes to develop and validate your data governance strategy, and then deploy it to production through mergeback. Mergeback is the process of moving validated metadata from a sandbox org back to a linked production org or another linked sandbox org. DevOps data kits move governance metadata between environments and maintain a consistent security posture.
Data Kit Types for Governance
Data 360 provides two data kit types.
- DevOps data kits: Used for sandbox-to-production mergeback between linked environments.
- Standard data kits: Used for packaging and deployment across orgs.
Governance Metadata in Mergeback
Mergeback moves metadata that controls access to your data.
- Tag assignments identify and classify data model objects (DMOs), data lake objects (DLOs), and calculated insight objects (CIOs).
- Governance policies control access to data and protect it.
- Record-level security (RLS) controls access to records. Use DevOps data kits to deploy governance components to the target org.
- Field-level security (FLS) controls access to fields.
- Object-level security (OLS) controls access to objects.
- Structured masking policies protect sensitive data.
Data Governance Support for Mergeback
Mergeback supports these data governance features.
- Assigning standard tags to Data 360 objects
- Applying governance policies based on standard tags, including:
- RLS policies
- FLS policies
- Object-level structured masking policies
DevOps Data Kit Deployment Model for Governance
DevOps data kits group governance components and deploy them to the target org.
- Capture relationships between governance policies and Data 360 objects.
- Use built-in deployment mechanisms, including change sets.
- Add data assets such as DMOs or DLOs to a DevOps data kit. Associated governance policies and tag assignments are included automatically.
You can’t add policies or tag assignments to a data kit on their own.
Note For RLS with joins, make sure all referenced objects exist in the target org or deploy
them using DevOps data kits before activating the policy.
Unsupported Governance Capabilities in Mergeback
Mergeback doesn’t support these capabilities.
| Unsupported capability | What to do instead |
|---|---|
| Creating custom tags in a sandbox and deploying them to production | Recreate custom tags manually in the target production org before deployment. |
| Assigning custom tags through mergeback | Assign custom tags manually in the target org after deployment. |
| Applying policies based on custom tags | Use standard tags for mergeback-supported governance policies. |
| Applying policies that combine standard and custom tags | Redesign the policy to use only standard tags before deployment. |
| Using custom tags during mergeback, even if they exist in the target org | Reapply or manage custom tag usage directly in the target org. |
| Unstructured data masking policies | Configure unstructured masking policies separately in the target org. |
| RLS hierarchy operator policies | Use supported RLS policy types for mergeback deployments. |
| Deleting governance metadata during mergeback | Manually remove policies or tag assignments from the target org using the Data Governance UI or supported APIs. |
Governance Mergeback Deployment Considerations
When planning your migration, consider these specific behaviors.
- Supported deployment paths: Mergeback supports deployments only between related Data 360 environments, such as sandbox-to-production or sandbox-to-sandbox.
- Deletion not supported: Removing a policy or tag assignment in a sandbox doesn’t remove it from the target org.
- CLI not supported: Salesforce CLI doesn’t support governance policy deployment.
- System-defined tags: Salesforce provides and maintains the system-defined tag taxonomy. Don’t rename, delete, or reassign these tags because governance policies depend on them. Any modifications are reverted during platform updates.
- Transaction limits: Large deployments may require batching.
- Deploy Data 360 Governance Policies with DevOps Data Kits
Migrate your data governance policies from sandbox to production orgs using DevOps data kits. This approach maintains consistency and reduces manual errors. - Troubleshoot Data 360 Governance Mergeback Deployments
When you migrate your data governance metadata, you can sometimes encounter deployment errors. Review the symptoms and solutions for common mergeback issues so that you can successfully complete your deployment across environments.