Data360 Govern

As we are updating the UI for the Relationships tab we wanted to address this question that has come up with several customers, please tell us your opinion on how Permissions are enforced when creating relationships between assets.

Currently, when creating a relationship on the Relationships Tab, the user must have create relationship permissions on the subject asset and the object asset.  However, some customers have expressed the desire to allow a user to create relationships even when they only have permissions for the asset item they are inspecting.

For example:  If the user has create relationship permissions for AssetTypeA but only has read relationship permissions for AssetTypeB, the current functionality will NOT allow the user to create a relationship between an AssetTypeA item and an AssetTypeB item.

However, with the less restrictive permissions, since the user has create relationship permissions for AssetTypeA, they could create a relationship to an AssetTypeB item.  They would not be able to create relationships if they were inspecting an AssetTypeB item as they only have read relationship permissions for AssetTypeB.

Would this less restrictive functionality be of benefit to you and your users?  Let us know before the end of January what you think.  We would love to hear from you! 

Thanks!

Danielle McQuaid

Product Management

In my opinion, the current functionality is appropriate. We use the permission functionality to grant broad Business-to-Technical mapping capabilities to all our Stewards. For Business-to-Business mapping involving multiple owners, we expect users to go through a workflow and get agreement from the other Owner in this scenario.

I'm in favor of allowing the relationship creation when you have the permission to do it for the source asset, even if you don't have it for the target.

So the question really is should you be allowed create a relationship between two objects even if you don't have permission to see one edge of the relationship. If we think of permissions as "Right to see" an asset's contents, then if the contents of the asset is hidden and all I get is the key for the asset in order to set a relationship then I don't see why not. The permissions relate to seeing the contents of the asset and not the ability to create a relationship. Now if you wanted the best option, allow for optimistic or restrictive relationships which give the clients the option for either 

As usual, Pat proposes the right approach :-)