Skip to content

EntiHub Documentation

Data Access Entitlement Registry

Data Access Entitlement Registry

Entitlements describe permitted access as business records with expiry and justification, aligned with permissions/RLS patterns.

Why this is needed

Access spreadsheets go stale after every reorg.
Recertification campaigns need a system of record.
AI tools need to know what a persona may retrieve.

Proposed entities in EntiHub

Governance settings

Setting	Recommended value	Why
`approvalRequired`	`true`	Access grants are controlled changes.
`historyEnabled`	`true`	History supports access reviews.
`allowSameAuthorApproval`	`false`	Maker/checker separation for sensitive changes.
`deletedRetentionDays`	`90` (or higher)	Soft-delete retention for auditability.

Entity definition (YAML sketch)

name: data_entitlement
displayName: Data entitlement
domain: Security
description: Data entitlement
version: "1.0.0"
approvalRequired: true
historyEnabled: true
deletedRetentionDays: 90
displayRefColumn: entitlement_code
uniqueConstraints:
  - name: uq_data_entitlement_entitlement_code
    columns: [entitlement_code]
columns:
  - name: entitlement_code
    dataType: string
    nullable: false
    maxLength: 64
  - name: principal_name
    dataType: string
    nullable: false
    maxLength: 128
  - name: principal_role
    dataType: string
    nullable: false
    maxLength: 64
  - name: data_domain
    dataType: string
    nullable: false
    maxLength: 64
  - name: region_scope
    dataType: string
    nullable: false
    maxLength: 32
  - name: access_level
    dataType: string
    nullable: false
    maxLength: 16
  - name: justification
    dataType: string
    nullable: false
    maxLength: 1000
  - name: valid_until
    dataType: date
    nullable: false
  - name: status
    dataType: string
    nullable: false
    maxLength: 16

YAML sketches

Sketches highlight the important fields and governance flags. Trim or extend columns to match your domain. See Setup Entity for the full YAML reference.

Sample data

entitlement_code	principal_name	principal_role	data_domain	region_scope	access_level	justification	valid_until	status
ENT-1001	anna.novak	Finance Analyst	revenue	EU	read	FP&A monthly close	2027-01-01	active

Benefits for the company

Recertification has a clear list to renew or revoke.
Aligns justification with technical RLS.
Expires access from a process perspective.