Data mesh: domain-owned products with federated computational governance

Data mesh масштабирует ownership и change across domains. Его unit — usable, discoverable, addressable, trustworthy data product, а не копия таблицы без владельца. Shared platform уменьшает cognitive load; federated governance делает cross-domain ecosystem interoperable.

Корректная модель

• Four principles are collectively: domain ownership, data as a product, self-serve platform and federated computational governance.
• A data product includes data, metadata, code/policy, quality/SLO, discoverability and one accountable owner.
• Federated policy standards need runtime data-plane enforcement, identity/credentials, audit and revocation.
• Central platform capabilities and global interoperability prevent decentralization from becoming incompatible silos.

Границы и компоненты

Сценарии

Publish a domain data product

Orders team uses platform templates, registers owner/schema/SLO/purpose policy and publishes only after automated and domain acceptance checks.

Проверяемый исход: The product has one accountable on-call/roadmap owner and a runtime endpoint, not only catalog metadata.

Contract evolution with consumer compatibility

A breaking field semantic change creates a new contract version and migration window. Catalog impact analysis identifies consumers; old version remains until declared deprecation gates pass.

Проверяемый исход: CI checks plus runtime/version telemetry prevent silent consumer breakage.

Runtime access enforcement

Consumer authenticates at the gateway. Gateway asks the federated policy plane for a decision, obtains/scopes short-lived data credentials through the platform integration, enforces row/object/query controls and audits the actual read.

Проверяемый исход: An allow decision alone is never described as credentials, enforcement, audit or revocation.

Quality/security incident ownership

Freshness or contract quality fails after publication. Runtime monitor/gateway blocks or marks affected version, domain owner responds, platform supports rollback, and consumers see status.

Проверяемый исход: Ownership is operational and user-visible; a CI-only pass cannot mask runtime failure.

Failure, concurrency и replay checklist

• One named domain owner/on-call per product; shared ownership ambiguity is a defect.
• Version contracts and measure real consumer usage before deprecation.
• Fail closed on expired identity, policy errors or broken classification for sensitive data.
• Exercise runtime access revocation, product rollback, freshness incidents and audit retrieval.

Формулы, units и допущения

• Product SLO must state freshness, completeness/quality, availability and support boundary with units; a single uptime percentage is insufficient.
• Platform success is measured through lead time, reuse, policy coverage and domain cognitive load, not number of tools.
• Cross-domain joins inherit the slowest relevant freshness/quality contract and need explicit semantic ownership.

Числа выше — учебные inputs или размерностные формулы. Их нельзя выдавать за benchmark или SLA конкретного продукта.

Связанные темы

[CONCEPT]etl-vs-elt

[CONCEPT]iceberg-deltalake-hudi

Первичные источники

• https://martinfowler.com/articles/data-monolith-to-mesh.html
• https://martinfowler.com/articles/data-mesh-principles.html
• https://martinfowler.com/articles/designing-data-products.html
• https://csrc.nist.gov/pubs/sp/800/207/final

Scope note

Диаграмма показывает причинные границы и recovery contracts, а не скрытую реализацию конкретного managed-сервиса. Любая stronger guarantee действует только в явно названной transaction/checkpoint/acknowledgement boundary.