A data governance framework is the set of decisions about who may do what with your data, and how those decisions are actually enforced. It has four parts, and the diagram below shows why missing one makes the other three unenforceable.
The four parts
- 1People: named humans, not a committee. Every data set needs one owner who is accountable for it and a steward who curates its meaning. ‘The data team’ is not an owner, because when a definition is disputed there is nobody who can settle it.
- 2Policies: written down, and short enough to be read. Who may see which rows, how long data is retained, what may leave the country, what needs masking. A policy nobody has read is functionally the same as no policy.
- 3Processes: the routine that keeps it true. Change requests, access reviews, quality checks that run on a schedule. Governance decays without a routine, because the organisation changes and the rules quietly stop matching it.
- 4Platform: where the rules are actually applied. Access enforced when the query runs, lineage and audit captured automatically. This is the part that turns the first three from documentation into behaviour.
Who decides what
- Owner – accountable for the data set, and decides who may use it.
- Steward – keeps definitions and quality right day to day.
- Custodian – runs the system the data lives on.
- Consumer – uses the data, and is sometimes told no.
Why frameworks fail
The usual failure is a policy document with no enforcement path. Rules live in a wiki, access is granted by ticket, and within two quarters nobody can say who can see what. The fix is not a longer document – it is moving each rule to somewhere the platform can apply it automatically, and accepting that a rule the platform cannot enforce is a wish.
Governance and AI agents
Agents make this urgent. When a person queries data, their access is checked against their identity. When an agent does it, the question is whose access it is using. Per-user scope, and an audit log that records which human the agent was acting for, is what keeps an agent inside the same rules as the person operating it.
What makes it enforceable
Governance depends on knowing where data came from and where it went, which is exactly what data lineage provides, and on agreed definitions, which is what a semantic layer holds.
What this looks like in Peliqan
Access in Peliqan is granted per user and applied when the query runs, across 300+ sources and every model built on them – including requests arriving from an AI client over MCP, which are scoped to the person making them rather than to a shared key.
Use this diagram wherever you like
The diagram is free to use, including commercially, as long as there is a visible link back to this page. Download the PNG for slides and documents, or the SVG if you want to edit the labels. No email required. You can browse the rest of the set in the Peliqan diagram library.
Ready to build this on your own data? Get started with Peliqan.
