Key Takeaways
As organizations scale data access provisioning across business units, the cracks in centralized data governance models become harder to ignore. Data stewards and platform teams are increasingly asked to support decentralized teams and use cases — but the tools they rely on weren’t designed to do so.
Most traditional metadata catalogs and governance platforms take a top-down approach. They require manual column-level tagging, rely on static schemas, and – critically – live outside the context where policies are enforced. That’s a problem. Data teams are left stuck maintaining brittle mappings, while domain governors — who understand the data best — are left without a way to govern what they own.
Immuta introduced Domains as a way to enforce policy in a way that reflects real-world data ownership. Domains allow platform teams to delegate governance — including data identification, policy authoring, and monitoring — to the right people, without sacrificing consistency or control.
Now, with the launch of identifiers in domains, domain governors can define and manage sensitive data identifications natively within Immuta — and eliminate reliance on external tools or centralized bottlenecks.
Identifiers are a way to classify sensitive data elements, such as names, emails, social security numbers, or employee IDs. They play a role in determining what protections, like masking, row-level filtering, and purpose-based access, should be applied to which data.
Within Immuta, there are two types of identifiers:
With identifiers in domains, you can tag columns containing sensitive attributes. Those attributes are:
This capability fills a gap that traditional metadata catalogs can’t solve. It ties identification directly to access provisioning in a decentralized model.
Let’s look at how this addresses common pain points in large data environments:
| Challenge | Traditional Approach | Immuta with Identifiers in Domains |
|---|---|---|
| Sensitive data tagging | Manual, centralized, disconnected from policy enforcement | Defined within domain, inherited by tables automatically |
| Domain-based governance | Difficult to support with global tags or static schemas | Scoped identifiers empower local control |
| Policy consistency | Risk of drift between catalog and enforcement layer | Immuta enforces directly where data access happens |
By aligning sensitive data identification with domain ownership, Immuta makes governance both scalable and context-aware.
Here’s how data platform teams and domain governors can start using identifiers in domains:
Start by defining domains that align with your data governance model (e.g., HR, Marketing, Finance).
Now that domains are established, you can create identifiers within them.
– Provide a name (e.g., employee_id, ssn, customer_email) and description.
– Configure the matching criteria (regex, column‑name regex, or dictionary).
– Select tags to apply.
Once an identifier is defined, Immuta automatically scans all tables in the domain to detect and tag matching columns. For you, this means:
Now domain governors can write policies that apply to their tables using tags placed by the scoped identifiers. Using Immuta’s plain-language policy builder or API, they can create:
Policies reference the tags applied through domain-scoped identifiers, enabling consistent, scalable enforcement without needing to specify individual columns. This allows domain governors to manage access confidently and independently while staying aligned with organizational standards.
See how it works in practice here:
As organizations embrace decentralized data architectures, like data mesh, governance and provisioning tools must evolve. Immuta’s identifiers in domains capability is a practical step forward, offering decentralization without sacrificing policy consistency or operational efficiency.
By putting identification and control in the hands of domain governors, Immuta enables you to:
This is what governance looks like when it’s built into the platform, not bolted on.
Experience identifiers in domains.
