Hi! A couple of questions about authorization: I would like to define a policy such as: allow some users/groups to edit description for the datasets in a given data platform instance. This is somehow similar to this one: https://datahubproject.io/docs/authorization/policies#coming-soon

• Ability to define Metadata Policies against multiple reosurces scoped to particular “Containers” (e.g. A “schema”, “database”, or “collection”)

Just going higher in the hierarchy up to the platform instance level. In the current status, I was thinking on solving this with

resource_urn

criteria https://datahubproject.io/docs/authorization/policies#resources Does that criteria support other operators different from

EQUALS

such as starts with, contains or even regexp? Definitely in the UI this is not possible, is it possible via policy as code? Second question is about applying to owners.

Whether this policy should be apply to owners of the Metadata asset. If true, those who are marked as owners of a Metadata Asset, either directly or indirectly via a Group, will have the selected privileges.

Can this be restricted to some ownership in particular? Thanks

hey Sergio! as an answer to your first question, unfortunately that's not possible right now as our graphql endpoint only allows you to set

EQUALS

as you pointed out (so it's not just the frontend with this limitation). as it stands right now, the best way to limit create a policy for a subset of resources not specific to a singular entity type, would be to group data assets into a Domain. However, being able to set policies based on higher level containers obviously makes a lot of sense, same thing with at the data platform instance level!

Thanks Chris! Any plans for this?

being able to set policies based on higher level containers obviously makes a lot of sense, same thing with at the data platform instance level

and for your second question, do you mean a specific type of ownership? or specific individuals?

Yes, specific type of ownership. At this moment we track two types of owners in the Data Catalogue for datasets: • DATAOWNER… group actually and legally owning the data (there can be multiple in a dataset) • TECHNICAL_OWNER… the group that owns the dataset resource (1 for a dataset) They can and are usually different We would like to restrict dataset metadata updates (doc, schema, etc) only to the TECHNICAL_OWNER (the resource/dataset owner)

as of right now it's not specifically slotted for work, but this makes total sense to me. Would you mind opening a feature request for it? that really helps the core team prioritize work and I could see others wanting the same thing!

https://feature-requests.datahubproject.io/p/authorization-policy-restricted-to-_eg_-technical_owners-owners https://feature-requests.datahubproject.io/p/authorization-policies-restricted-to-platform-instance-owners