Data Management (DMS) controls database operations through a three-layer framework: approval nodes define who can approve, approval templates define the approval sequence, and security rules define which operations require approval and map those operations to specific templates. Associate a security rule with an instance to enforce consistent access and change controls across your database fleet.
How the three layers work together
When a user submits a ticket (for example, a data change or data export request), DMS evaluates the applicable security rule for that instance. If the operation matches a rule control that requires approval, DMS routes the ticket through the approval template linked to that control. The template runs the nodes in sequence — for example, data owner, then DBA — until all required approvers have acted.
Approval nodes
An approval node represents a role or individual that can approve tickets. DMS provides two types: system nodes and custom nodes.
System nodes
System nodes are built-in and cannot be edited or deleted.
| Node | Who can approve |
|---|---|
| Admin | Any DMS administrator. If multiple administrators exist, any one of them can approve the ticket. |
| DBA | The database administrator (DBA) of the managed instance. Defaults to the administrator or DBA who registered the instance, but can be reassigned to another DBA role. |
| DBA Roles | Any DBA in DMS, including DBAs of managed resources. |
| Owner | The data owner of a database or table. The DBA can assign a data owner when registering an instance and collecting the data dictionary. An administrator can also assign data ownership, and users can request to become data owners. |
Custom nodes
Custom nodes can be edited and deleted as needed. Define the node name and specify the approvers.
Approval templates
An approval template defines the sequence of approval nodes that a ticket must pass through. DMS provides system templates and custom templates.
System templates
System templates are built-in and cannot be edited or deleted.
| Template | Approval sequence |
|---|---|
| Admin | Administrator only |
| DBA | DBA only |
| Owner | Data owner only |
| Owner->DBA | Data owner, then DBA |
| Owner->DBA->Admin | Data owner, then DBA, then administrator |
Custom templates
Custom templates can be edited and deleted as needed. Combine system nodes and custom nodes to build the approval sequence that fits your workflow.
Security rules
Security rules define which database operations require approval and link each operation to an approval template. DMS includes three built-in security levels — low, medium, and high — which can be edited but not deleted. Custom security rules can be edited and deleted as needed.
An instance can be associated with one security rule. Depending on your business needs, you can strictly control the test environment but loosely control the production environment of the back-end system.
The following sections describe the controls available in each module.
SQL console
Configure controls for queries run directly in the SQL console.
Whether data manipulation language (DML) statements can run. Set a row count threshold — DML is blocked if the threshold is exceeded.
Whether data definition language (DDL) statements can run. Set a table size threshold — DDL is blocked if the threshold is exceeded.
Whether high-risk DDL operations can run (for example, deleting tables or deleting fields).
Whether other SQL statements can run.
Data changes
Configure controls for data change tickets submitted through DMS.
Whether DML statements can run. Set an affected row count threshold — DML is blocked if the threshold is exceeded.
Whether DDL statements can run. Set a table size threshold — DDL is blocked if the threshold is exceeded.
Whether high-risk DDL operations can run (for example, deleting tables or deleting fields).
Whether other SQL statements can run.
When you enable any of the above controls, select an approval template and an approval process flow based on your requirements.
Data export
Specify whether data export tickets require approval. When enabled:
Set or modify the threshold for data export.
Assign different approval templates for different thresholds.
If the data to be exported contains rows with sensitive data, configure an approval template that skips those rows. If you need to export sensitive data, configure a dedicated approval template for that case.
Permission application
Configure approval workflows for the following permission request types.
Permissions on databases, tables, or columns
| Permission type | Description |
|---|---|
| Databases or tables | Approval flow for access to a database or table |
| Sensitive columns | Approval flow for access to sensitive columns |
| Confidential columns | Approval flow for access to confidential columns |
Data owner
| Scenario | Description |
|---|---|
| Data owner exists | Approval flow when the database or table already has an assigned data owner |
| No data owner | Approval flow when no data owner is assigned |
Sensitivity level changes
| Change | Description |
|---|---|
| Confidential to sensitive | Approval flow for lowering the security level from confidential to sensitive |
| Confidential to internal | Approval flow for lowering the security level from confidential to internal |
| Sensitive to internal | Approval flow for lowering the security level from sensitive to internal |