Reference Architecture Diagram + Narrative (classify → control → consent → prove)
┌─────────────────────────────────────────────┐
│ DATA UNIVERSE │
Sources: Apps/APIs | SaaS | Lakehouse | Streams | OT/IoT | Voice/Text │
└───────────────┬───────────────┬─────────────┘
│ │
▼ ▼
┌────────────────────────────────────────────────────────────────┐
│ DISCOVERY & CLASSIFICATION (continuous, agent+API) │
│ • Scanners: db/obj/files/stream schemas • NLP for PII/PHI/PCI │
│ • Classifiers & labels (public/int/conf) • Data lineage hooks │
└───────────────┬─────────────────────────────┬──────────────────┘
│ │
▼ ▼
┌─────────────────────────────────────┐ ┌───────────────────────────────────┐
│ GOVERNANCE CATALOG & POLICY ENGINE │ │ CONSENT / RIGHTS OPS (DSAR/CP) │
│ • Glossary, owners, SLAs │ │ • Consent store (purpose, ttl) │
│ • Policies (OPA/Rego): residency, │ │ • DSAR orchestration (search, │
│ retention, masking, access │ │ extract, redact, deliver) │
└───────────────┬─────────────────────┘ └──────────────┬───────────────────┘
│ │
▼ ▼
┌─────────────────────────────────┐ ┌──────────────────────────────────┐
│ ENFORCEMENT FABRIC (inline/API)│ │ TRUST SERVICES (CUSTODY) │
│ • DLP (inline & SaaS API) │ │ • HSM/KMS/PKI (keys, tokens) │
│ • Tokenize/mask/pseudonymize │ │ • WORM store (legal holds) │
│ • Row/col-level security (ABAC)│ │ • Sign/attest lineage changes │
└───────────────┬─────────────────┘ └──────────────────┬────────────────┘
│ │
▼ ▼
┌─────────────────────────────────┐ ┌─────────────────────────────────┐
│ ACCESS & SHARE BROKERS │ │ EVIDENCE & REPORTING │
│ • API GW / brokered sharing │ │ • GRC dashboards (GDPR/CCPA, │
│ • Contracted datasets (SLAs) │ │ HIPAA, PCI, CJIS, ISO, SOC2) │
│ • Partner allow-lists/tenancy │ │ • Audit packs (immutable) │
└─────────────────────────────────┘ └─────────────────────────────────┘
Telemetry & Ops ──► SIEM/SOAR (exfil/leak) • AIOps (drift) • ITSM/CMDB (owners/changes)
Narrative (how meaning is governed, privacy is honored, and proof is produced)
1) Purpose & posture
- Objective: Create a cross-domain fabric that discovers, classifies, governs, and enforces data policy everywhere—while capturing consent, fulfilling data-subject rights, and proving compliance on demand.
- Posture: Policy-as-code, data-first controls, identity-aware access, immutable evidence.
2) Discovery & classification (syntax of what exists)
- Continuous scanners (agents + APIs) index databases, object stores, files, streams, voice/text.
- NLP/regex classifiers detect PII/PHI/PCI and sector tags; outputs become labels that follow data through lineage.
3) Catalog & policy (semantics of what it means)
- Central governance catalog maps business glossary → technical assets → owners → SLAs.
- OPA/Rego policies encode residency, retention, masking, access/ABAC, and purpose limits; versioned and testable.
4) Enforcement (law in motion)
- DLP inline (network/SASE) and SaaS/API mode (email/drive/chat).
- Tokenization/masking/pseudonymization at read or ingest; row/column-level security enforced by ABAC attributes (user, role, purpose, region).
- Controls bind to apps, BI, ML, APIs through sidecars, UDFs, or gateways.
5) Consent & rights ops (pragmatics for people)
- Consent store records purpose, scope, TTL, provenance per subject.
- DSAR orchestration (GDPR/CPRA): search → collect → redact → deliver; generates immutable evidence and deadlines.
- Preference signals (opt-in/out) push into CDPs, marketing, and analytics.
6) Custody & evidence (the memory of law)
- HSM/KMS/PKI guard keys and tokens; WORM holds legal snapshots, policy versions, consent records, and DSAR packets.
- Every lineage/policy change is signed/attested and queryable.
7) Access & sharing (safe collaboration)
- API gateways/brokers expose contracted datasets with SLAs, quotas, schemas, and partner allow-lists.
- Tenant isolation and purpose-bound tokens keep exchanges within lawful context.
8) Operations & detection
- SIEM/SOAR correlates exfil/leak signals; playbooks revoke tokens, mask on the fly, page owners, open ITSM.
- AIOps watches policy drift, stale labels, and orphaned datasets; nudges owners to remediate.
Reference KPIs
- Classification coverage: ≥98% of in-scope assets labeled within 24h
- DSAR SLA: 100% responses within legal window (e.g., ≤30 days)
- Consent sync latency: <5 min to all downstream processors
- Policy conformity: >98% (residency/retention/masking)
- Exfil MTTR: ≤1 h; False sharing blocks: <1% (tuned)
Minimal BOM (aligned with prior stack)
Discovery/classification scanners (db/obj/files/streams/voice), Lineage/catal og, OPA/Rego policy engine, DLP (inline + SaaS API), Tokenization/Masking/Pseudonymization services, ABAC/RLS controls, Consent/DSAR orchestration, HSM/KMS/PKI, WORM evidence store, API gateway/broker, SIEM/SOAR, AIOps, ITSM/CMDB, GRC dashboards.