Domains¶

A domain is the accountability boundary for everything you govern: it decides who may edit an asset and who signs it off.

Lives at/domains

Governs11 asset types

NestingUp to 5 levels

ScopesWrites & approvals — never reads

When to choose this¶

You need accountability, not secrecy

A domain says who is answerable for an asset. Finance work is edited and approved by Finance. It never hides anything: every list, search and lineage view stays open.
Approvals must route somewhere

Submitting an asset for approval requires a domain, because the domain is what decides who reviews it. An asset with none cannot be submitted at all.
Your organisation nests

Finance contains Billing contains Payroll. Membership flows down the tree, so a Finance steward governs everything under Finance without being added to each one.

When not to reach for this

A domain is not a permission to see something. It scopes writes and approvals only — if you need to stop people reading data, that is a different mechanism. Filing an asset into Finance does not hide it from anyone.

How it works¶

Two questions get asked of a domain, and they have different answers.

flowchart LR
    A["Someone edits an asset"] --> B{"Does it have<br/>a domain?"}
    B -- "No" --> C["Anyone with the<br/>module permission may edit"]
    B -- "Yes" --> D{"Are you a member<br/>of that domain?"}
    D -- "No" --> E["Refused"]
    D -- "Yes" --> F{"Do you hold the<br/>module permission?"}
    F -- "No" --> E
    F -- "Yes" --> G(["Allowed"])
    classDef accent fill:#ff8400,stroke:#e67700,color:#ffffff,font-weight:600;
    class G accent

Figure 1 — membership is scope, never permission. You need both.

Why teams reach for this

Adding someone to Finance does not hand them anything on its own. It narrows which assets their existing permissions apply to. That is what makes it safe to give people broad module roles.

In the Data Catalog you see the answer before you try. An asset in a domain none of your groups work in opens read-only: no edit controls, and the page header says Editing · Outside your domains, with the reason a click away. You can still read everything on it, its drafts included, but you cannot change a draft there, even one you started.

Coverage — the number to watch¶

The front door leads with one figure: how many of your governable assets actually carry a domain. It matters because every guard in the platform quietly does nothing on an asset that has none — writes stay open, and the asset cannot be submitted for approval.

Reading	What it means	What to do
High coverage	Governance is doing what you think it is	Nothing
Low coverage	The guards exist but decide nothing	File assets from each module's own list
Cannot be measured	A count failed — not the same as "nothing filed"	Retry; check server logs

Open a domain to see what it governs, broken down by type. The counts include archived assets, because those still belong to the domain.

Each count is a way through, not just a number: open one and you land in that module's own list, already filtered to this domain. A banner names the domain you are scoped to, with a one-click way back out.

The permission that decides what you see there is the module's own, not the domains one. This page never lists another module's assets — that would let anyone who can read domains enumerate metric, dashboard and contract names their own roles do not admit them to. So a count you can see may still refuse the click, and that refusal comes from the module that owns the data.

flowchart LR
    A["Domain detail page"] --> B{"Open a count"}
    B --> C["That module's own list"]
    C --> D{"Do you hold the module's read role?"}
    D -- "No" --> E["Refused by that module"]
    D -- "Yes" --> F(["The list, scoped to this domain"])
    classDef accent fill:#ff8400,stroke:#e67700,color:#fff;
    class F accent

Sub-domains¶

A domain may nest under one parent, up to five levels deep. The tree is what makes membership scale: bind a role group to Finance once, and it governs every domain beneath it.

Rule	Behaviour
One parent	Re-parenting replaces the previous parent
No cycles	A domain cannot sit inside something it already contains
Inheritance direction	Down only. Billing membership grants nothing in Finance, and nothing in a sibling
Both capacities	Members and stewards both inherit downward
Depth cap	Five levels; a deeper move is refused rather than silently truncated

A sub-domain with no steward of its own

That is normal, not a gap. Approvals route to the nearest ancestor that has one, and the domain page says so rather than warning you.

Deleting a domain¶

A domain that still governs something cannot be deleted. This is deliberate: a deleted domain leaves assets pointing at nothing, and an asset pointing at nothing routes its reviews to nobody — silently.

flowchart LR
    A["Delete domain"] --> B{"Count what<br/>references it"}
    B -- "Counting failed" --> C["Refused — cannot verify"]
    B -- "Assets or sub-domains" --> D["Refused — names what blocks it"]
    B -- "Nothing" --> E(["Deleted"])
    classDef accent fill:#ff8400,stroke:#e67700,color:#ffffff,font-weight:600;
    class E accent

Figure 2 — the guard fails closed. "We could not tell" refuses too.

The refusal names what is in the way, per type, so you can go and reassign it. Archived assets count: they still reference the domain, and restoring one later would resurrect the problem.

Limitations¶

Limitation	Why
A governing domain is single	An authorization check cannot ask "which of these three decides"
Reads are never scoped	A domain is an accountability boundary, not a confidentiality one
A domain is optional on an asset	Requiring one would be a migration disguised as a security control
Membership binds role groups	Per-user assignment does not survive joiners, leavers and movers

Troubleshooting¶

Symptom	Cause	Fix
"Cannot be submitted for approval"	The asset has no governing domain	File it into one from its own module
Work here can never be approved	The domain has no steward, directly or inherited	Add a steward under Manage members
Delete refused, naming counts	Assets or sub-domains still reference it	Reassign or archive them, then delete
Delete refused, cannot verify	A reference count failed	Retry; the guard refuses rather than risk orphaning
You are a member but still refused	Membership is scope, not permission	You also need the module's own role