Governance

Moving data into the cloud is where governance either happens or it does not. BARRY builds it into the runtime rather than bolting it on afterwards — masking, lineage, alerting, secrets and access control are all first-class, and each is off until you decide you need it.

PII detection and anonymization run server-side, powered by the Presidio Data Privacy Stack running as sidecar containers, and inspect data as it moves. The feature is gated globally and opted into per transport. Detection flags a transport as Restricted, so an auditor can see at a glance which pipelines touch sensitive data; anonymization goes further and masks the values before they ever reach the sink.

Lineage is built from the pipelines you already run — sources, transports and destinations, down to the individual column — so you can answer where a number came from without maintaining a diagram by hand. Schema changes are recorded per run, which lets you trace a surprising value back to the moment its column changed, and the same lineage exports through OpenLineage into Marquez, DataHub or your own catalog.

Alerts are outbound: when a run reaches an outcome you care about, BARRY notifies a channel such as Teams, Slack or a webhook. Secrets never sit in plain configuration — connection credentials are vault-backed references, resolved at run time from Azure Key Vault or HashiCorp Vault, so the real secret never lands in the metadata database.

Two more layers close the loop. Access control governs who can see and change what. The data firewall adds explicit allow and deny rules between a source and a destination — default-deny once enabled — so a client can only move data along paths you have sanctioned. None of this is a separate product to integrate; it is the same runtime, with governance turned on where you need it and out of the way where you do not.

← All documentation