Lesson 3 · Govern

Governance & Data Contracts

Layer governance onto the catalog you built — glossary, classification, ownership, data quality — then see how a data contract binds all of it to one dataset, enforceably. This is where your real project lives.

3.1 — The four pillars

Governance in OpenMetadata isn't one feature — it's several layers attached to entities.

DMBOK lens

These pillars map straight onto DAMA-DMBOK: glossary, ownership and stewardship → Data Governance; classification / PII tags → Data Security; test cases → Data Quality; and the contract ties them together. The full mapping — and where the tool stops and organisation begins — is in the conclusion.

a) Glossary — shared business language

A glossary is a controlled vocabulary of business terms (Customer, Net Revenue, PII), each with a definition and owner. Glossary terms attach to tables/columns so business meaning travels with the data.

Tags vs glossary terms

Classification/tags answer "what kind of thing is this?" (technical). Glossary terms answer "what does this mean to the business?" (semantic).

Do thisCreate a glossary term
  • Govern → Glossary → Add Glossary. Name: Shop Business Terms. Description (required): "Shared business vocabulary for the online shop." → Save.
  • Add Term. Name: Customer Email. Description: "A customer's email address — personal data (PII)." → Save.
  • Attach it to the email column of the customers table.
Adding the Customer Email term to the glossary
Adding the Customer Email term to the Shop Business Terms glossary.
Attaching the glossary term to the email column of customers
Attaching the term to customers.email — the business meaning now travels with the column.
The finished glossary term Customer Email
The finished glossary term in Shop Business Terms.

b) Classification & Tags — automatable labels

A classification is a group of tags. OpenMetadata ships with several, and the exact tag names vary by version. For sensitivity you'll usually find the PersonalData classification (tags Personal, SpecialCategory) and a General classification (tags Sensitive / NonSensitive). Tags drive policy: mark data as sensitive, then build access policies and contract rules on those tags.

No PII.Sensitive? That's normal

Older guides mention a PII.Sensitive tag that may not exist in your version. Use whatever sensitivity tags your instance offers — commonly Personal and Sensitive — or create your own (optional exercise below).

Do thisTag the email column as sensitive
  • On the customers table → email column → Tags → + Add.
  • Search and add the sensitivity tags your instance has — typically Personal and Sensitive. Save.
  • Note how the tags surface in search and on the entity. (OpenMetadata can also auto-classify PII during profiling.)
The email column with a description, the Customer Email glossary term, and Personal + Sensitive tags
The email column, fully governed: a description, the Customer Email glossary term, and the Personal + Sensitive tags.
OptionalCreate your own classification & tag

Want a tag that doesn't exist yet? Create one — this is how teams add their own labels.

  • Settings → Classifications (or Govern → Classifications) → Add Classification. Name: Data Sensitivity, description: "How sensitive the data is." → Save.
  • Inside it, Add Tag: name PII, description "Personally identifiable information." → Save.
  • Back on customers.email → Tags → + Add → apply your new Data Sensitivity.PII tag.

c) Ownership & Tiers — accountability

Every entity should have an owner (team or user) and a tier (Tier1 = business critical … Tier5 = sandbox). Ownership is who you escalate to; tier is how much the organization cares. Contracts and SLAs lean on both.

Do thisSet owner & tier
  • Set an owner and mark orders as Tier1 (it's business-critical).
  • Filter Explore by Tier1 to see how leadership finds the critical assets.
The orders table marked as Tier1 with an owner assigned
The orders table marked Tier1 with an owner — accountability and criticality, set.

d) Data Quality — is the data actually good?

Test cases assert expectations on tables/columns (row count > 0, column not null, values in a set, freshness, custom SQL). They run as a workflow and produce pass/fail history. This is the measurable half of a data contract.

Do thisAdd data quality tests
  • Open the orders table → Data Observability / Data Quality tab → Add Test.
  • Table Level → select table orders → Test Type "Table Row Count To Be Between" (⚠ not Column Count — that counts columns). Min 1, Max 1000. Name: orders_row_count_between. → Submit.
  • Add Test again → Column Level → column total_amount → Test Type "Column Values To Be Not Null". Name: total_amount_not_null. → Submit.
  • Defining a test doesn't run it. Go to the Test Suites tab → open the online_shop.shop.public.orders suite → Add Pipeline → Deploy → Run (a small agent, like ingestion).
  • Refresh after ~30s: both tests turn Success (green). orders has 7 rows (1–1000 ✓) and no null total_amount ✓.
Test Suite page where you deploy and run the test pipeline
Open the table's Test Suite and deploy/run the pipeline — that's what actually executes the tests.
Data Quality dashboard showing the tests passing
The Data Quality dashboard once tests have run — green Success is the measurable half of a data contract.
OptionalMake a test fail on purpose

Green is reassuring, but you only trust tests once you've seen one catch a problem. Let's force a failure.

  • Add Test → Table Level → orders → "Table Row Count To Be Between" → Min 100, Max 1000. Name: orders_row_count_min_100_FAIL.
  • Re-run the suite (Test Suites → orders → Run).
  • This test turns Failed (red) — orders has only 7 rows, not ≥100 — while the others stay green. The dashboard shows Failed 1.
  • That red is the point: a failing test is how a contract detects bad data. When done, delete it (⋮ → Delete) to keep the lab healthy.
Data Quality dashboard with one failing test in red
A deliberate failure: the row-count test goes red while the others stay green.

3.2 — Data Contracts: where it all comes together

A data contract is a formal, enforceable agreement about a dataset: its schema, quality guarantees, semantics, owner, and SLAs. It's not a new pillar — it's the binding of all four pillars to one dataset, made machine-checkable:

Contract elementComes from
Schema the consumer can rely onCatalog (Lesson 1)
Quality guarantees (tests must pass)Data quality (3.1d)
Semantics & classificationGlossary + tags (3.1a/b)
Ownership / SLAOwnership (3.1c)
Upstream dependenciesLineage (Lesson 2)

OpenMetadata has native Data Contract support: you define a contract on an entity, and it's validated against live metadata + quality results. When the table drifts (schema change, failing test), it's flagged.

The contract builder is a wizard with tabs that map almost one-to-one to ODCS: Contract Details, Terms of Service, Schema, Semantics, Security, Quality, SLA. You don't have to fill them all — here's a meaningful minimum for v_daily_revenue.

Do thisAuthor your first data contract
  • Open v_daily_revenue → Contract tab → Add Contract → Create Contract with UI. (Note the Import ODCS option — OpenMetadata can also load a contract from an open-standard file; more on that below.)
  • Contract Details: Title Daily Revenue Contract, set yourself as Owner, description "Guarantees for the daily revenue view."
  • Schema: tick the three expected columns — order_date, orders_count, revenue (already detected from the view).
  • SLA: Refresh Frequency 1 Day, Max Latency 2 Hours, Retention 1 Year, refresh Column order_date. (Semantics / Security / Quality are optional — skip for now.)
  • Save. Review the contract status. Imagine someone renames revenue upstream — the contract would flag the violation.
The saved data contract on v_daily_revenue
The data contract on v_daily_revenue — schema, ownership, and SLA bound into one enforceable agreement.
What a contract really gives you

A data contract turns implicit assumptions ("revenue is always there, daily, numeric") into an explicit, checkable agreement between producers and consumers. It's where catalog, quality, ownership and SLA stop being separate fields and become a single promise the platform can enforce.

3.3 — It's all an API

Everything you did by clicking is a REST call underneath. That matters for automation — scripted checks, CI pipelines, bulk updates, or wiring OpenMetadata to other tools. Two ways to drive it:

  • REST API — full CRUD over every entity, lineage, glossary, tests, and contracts. Browse it at localhost:8585/docs (Swagger).
  • Python SDK (openmetadata-ingestion) — a typed client over the same API.

A runnable starter lives at openmetadata-lab/api/explore_api.py — it authenticates and reads entities. Here's the shape of a first call:

python
import os, requests
API = "http://localhost:8585/api/v1"
H = {"Authorization": f"Bearer {os.environ['OM_JWT_TOKEN']}"}
# list database services — the 'services' from Lesson 1
r = requests.get(f"{API}/services/databaseServices", headers=H)
for s in r.json()["data"]:
    print(s["name"], s["fullyQualifiedName"])
Getting a token

Grab a JWT from Settings → Bots → ingestion-bot, set it as OM_JWT_TOKEN, then run python api/explore_api.py. Bots are how you authenticate programmatic clients.

3.4 — ODCS: an open standard worth knowing

The contract wizard's tabs mirror the Open Data Contract Standard (ODCS) — an open YAML standard (stewarded by the Bitol project under the Linux Foundation) that describes a dataset's schema, quality, SLAs, ownership and support in one document. OpenMetadata can import and export contracts in this format (the Import ODCS option you saw), so a contract stays portable and tool-agnostic. Worth knowing as the emerging lingua franca of data contracts.

Checkpoint — the whole platform

1. Tags vs glossary terms — what's each for?
Tags/classification = technical labels ("what kind of thing is this?", e.g. PII). Glossary terms = business semantics ("what does this mean to the business?", e.g. Net Revenue).
2. A data contract binds which pillars to a dataset?
All of them: schema (catalog), quality guarantees (tests), semantics & classification (glossary + tags), ownership/SLA, and upstream dependencies (lineage) — made machine-checkable.
3. Why does it matter that everything in OpenMetadata is reachable by API?
Because the UI is just a front-end over a REST API — so anything you do by clicking can be automated: scripted checks, CI pipelines, bulk updates, or integration with other tools.

Your deliverable

Here's what you've actually built across the three lessons — a real, governed catalog you can keep exploring: the online_shop source ingested, enriched, classified, owned, tested, traced and put under contract.

online_shop — cataloged & governed lineage customers PII · email glossary term description orders owner Tier 1 2 quality tests pass products cataloged v_daily_revenue · view data contract schema · SLA · owner + a business glossary, search across everything, and a full lineage graph. All running locally — yours to keep exploring.
Your deliverable: a governed online_shop catalog.
You now understand the whole platform

The catalog is the skeleton (L1). Lineage connects it into a graph (L2). Governance hangs off entities, and a data contract binds it all to one dataset, enforceably (L3). Next, step back from the buttons: how does all this map to the DAMA-DMBOK body of knowledge — and where does the tool stop and organisation begin?

Saves to this browser so you can pick up where you left off.