Phase C — Data Architecture
The platform's own data: the catalog that describes the enterprise schema, the policies that govern it, the artifacts agents produce, and the governance records that make every screen reproducible. The enterprise's business data itself stays in its systems of record and is only ever read through compiled, scoped queries.
C1 · Conceptual data modelEntities by domain — catalog, policy, use-case artifacts, governance, registry
Everything the generation side touches is metadata about data, never the data. The Release Unit is the entity auditors care about: it names exactly which versions of everything a reviewer approved.
C2 · Data lifecycle & disseminationFrom systems of record to a reproducible screen — and what never crosses which line
Two boundaries matter. Left of the dotted line, only metadata and sampled, masked profiles exist. Right of it, at runtime, production data flows — but only through compiled, entitlement-scoped SQL. Generation never crosses into production data.
C3 · Data security viewClassification × enforcement point — what happens to each data class at each stage
| Data class | Crawler / catalog | Scout (retrieval) | Composer | Verifier | Compiler / runtime | Review UI |
|---|---|---|---|---|---|---|
| Public / internal | Profiled normally; top-k values kept | Retrievable to any actor with table read | No policy required | Groundedness, cost | Row scope still applies | Shown |
| Confidential / financial | Profiled; values summarised, not listed | Retrievable only if actors hold the read role | @authorize(policy) mandatory; nullable | Policy coverage 100%; entitlement compile per role | Predicate injected; denied → null | Sample values only |
| PII (contact, identity) | Masked at profile time; no raw values in cards | Excluded from subgraph if no actor may read; flagged if present | Policy per field; never in list columns by default | PII exposure scan on sample results | Denied → null in projection; never selected-then-redacted | Masked preview |
| PHI / regulated | Domain enabled only with 100% classification coverage | Retrievable only for actors with the regulated role; audit event on retrieval | Policy per field; write targets never autonomous-safe | PII/PHI scan; a11y; golden tests include narrow-permission users | Predicate + column policy; every query logged with predicate set | Masked preview; reviewer must hold the role |
| Secrets / credentials | Never crawled (schema deny-list) | Not in the index | Cannot be referenced | Groundedness gate rejects any unknown table | — | — |
C4 · Data entity / application component matrixWho creates, reads, updates and retires each entity
| Entity | Crawler | Catalog svc | Policy svc | Intake | Scout | Composers | Verifier | Review UI | Registry | Compiler / runtime |
|---|---|---|---|---|---|---|---|---|---|---|
| CatalogVersion | C | R U | — | — | R | R | R | R | R | R (generation stamp) |
| TableCard / ColumnEntry / JoinPath | C | R U (owner review) | — | — | R | R | R | R | — | R (field map) |
| GlossaryTerm | C | R U | — | R U (learns) | R | — | — | — | — | — |
| Classification / EntitlementPolicy / PolicyVersion | — | R | C R U | — | R (pre-filter) | R | R | R | — | R (predicates) |
| UseCaseSpec | — | — | — | C U | R | R | R | R | R | — |
| Subgraph | — | — | — | — | C | R | R | R | — | — |
| SchemaSlice / PersistedOperation | — | — | — | — | — | C | R | R | R U (publish) | R |
| UISpec | — | — | — | — | — | C | R | R | R U | R (render) |
| CustomComponent / ComponentVersion | — | — | — | — | — | C (request) | R (scan) | U (approve) | C R U | R (load) |
| Run / GateReport | — | — | — | U | U | U | C | R | R | — |
| ReviewDecision / ReleaseUnit | — | — | — | — | — | — | — | C | C R U (state) | R |
| Proposal | — | — | — | — | — | — | — | R | — | C R (status); applied by owning system |