The minimum governance set that passes an audit

Governance initiatives arrive at our assessments in one of two states: nonexistent, or ambitious to the point of paralysis. The middle posture, a minimum set that auditors accept and engineers tolerate, is five controls. Everything else can wait for a reason to exist.

Access by role, through the catalog. Individual grants rot into archaeology. Role-based access administered where the data lives is now a first-class catalog feature; the current catalog generation carries fine-grained control natively, so the excuse expired. Access, not discovery, is why a catalog earns its keep; buy for this control and the search engine comes free.

Classification of the sensitive minority. Tag the columns that carry personal or regulated data, and let the tags drive masking automatically. Classifying all nine hundred tables is a program; classifying the forty that matter is a sprint.

Ownership with a name in it. Every dataset consumed across a team boundary has an owner who is a person, not a channel. Auditors ask "who decides"; a rota answers, a working group does not.

Change control at boundaries. Contract checks in CI on the interfaces other teams consume. Producers see breakage before consumers do, and the audit trail writes itself as pull requests.

Audit logging you can actually query. Who read what, when, answered from the platform's own logs within an hour, not from a ticket asking three teams.

The minimum set installs in a quarter because none of it waits on a platform decision: ownership is a spreadsheet with authority, change control is CI configuration, audit queries come with the warehouse. In assessments we schedule it as four two-week slices, one control each, with the owner rota first because every later control needs a name to page. Teams that attempt all four simultaneously finish none; the set is minimal partly so it can be sequenced.

The test for whether the minimum is holding: pick a sensitive column and ask who approved the last access grant, whether a breaking change on the table would have failed CI, and how long an audit query takes to answer. Under an hour each, from systems rather than memory, and the set is doing its work. Anything slower marks the control to fix next quarter.

Deferred without guilt: enterprise glossaries, stewardship councils, capital-P master data programs (a mapping table covers most of the need), lineage tooling beyond what the transformation layer emits for free. Each becomes worthwhile at a scale you will recognize when you reach it, and adopting them early mostly generates meetings about the meetings.