Policies

A policy in Metatate Cloud is the canonical, versioned record of one governance rule for your data estate. You author policies per workspace, and they target your catalog vocabulary first-class: the tables your connectors discover, the collections you group them into, and the taxonomy types you classify data with. Because targets are catalog references rather than free-typed strings, Metatate can resolve exactly which assets a rule governs — and tell you when it can't.

What a policy is

Each policy has a stable identity and a series of versions, and versions move through a lifecycle: draft, submitted for review, approved (or rejected). A version stores both your source text and the validated canonical policy it compiles to, and you can always view the raw YAML.

Create a policy

There are two ways to author, and you can move between them.

Describe your intent. Write what you want in plain language — for example, a rule about which teams can use customer contact data for analytics. Metatate proposes a structured draft from your description. The model is only a suggester: a deterministic compiler and validator produce the actual policy, and nothing takes effect without your review. Compilation happens server-side — model provider keys never reach your browser, and customer data is redacted before anything is sent to a model provider.

Author directly. Write or edit the policy definition yourself. The same validation applies, so a direct edit and an AI-assisted draft end up as the same kind of canonical policy.

In both flows, an @-style picker lets you reference catalog assets as you type — tables, collections, and taxonomy types — so the policy's targets stay attached to real catalog objects instead of strings that can drift.

Extraction: deployable instructions

From a valid policy version, Metatate extracts deployable instructions — the operational form of the policy. Each instruction carries the scenario it answers for, the decision (allow, deny, mask, and so on), its priority and enforcement mode, a reason, and provenance back to the policy version and targeted asset. Instructions, not policy prose, are what deployments publish and what answers cite. The policy detail view shows the definition, its extracted instructions, coverage of the targeted assets, and an activity history of versions and review events.

Review and approve

When a draft is ready, submit it for review. A reviewer approves or rejects the version; approval makes it the policy's current approved version and marks it ready for deployment.

Approved is not live

Approving a policy does not change any served answer. Answers — in the app and over MCP — come only from the current deployment publication's deployed instruction decisions. An approved version is ready state; it becomes live state when you publish it from Deployments. If you want to see the full loop on example data first, start from the sample workspace.