How access controls sync

In Data Access, access controls are independent of the technical implementation that enforces them in your target data sources. To keep your rules consistent, Data Access supports a bidirectional flow for access controls: it pulls from data sources (inbound) and pushes to data sources (outbound). However, each access control synchronizes in only one direction, depending on whether you manage it in the data source or in Collibra.

Note The exact synchronization behavior depends on the data source type, such as whether it uses a Role-Based Access Control (RBAC) model or an Access Control List (ACL) model.

Source of an access control

Every access control has a Managed in field, which defines the source of truth. This field indicates which system owns the access control: the data source or Data Access. Consequently, it determines the direction of data flow to prevent permissions from being unintentionally overwritten.

Inbound: Managed in your data source

If the Managed in field in an access control is Data Source, the synchronization direction is inbound, that is, from the data source to Data Access. An inbound direction indicates that the access control already existed in your data source and was imported into Data Access during data source synchronization. During subsequent synchronizations, Data Access pulls any changes made to the access control in the data source, which ensures alignment between both systems.

An inbound direction gives you immediate visibility into your current setup, and it does not require you to recreate access controls in Data Access. You can see who has access to what directly in Data Access. We recommend inbound direction for access controls that administrators or specific service accounts use and that you simply want to set and forget.

Outbound: Managed in Collibra

If the Managed in field in an access control is Collibra, the synchronization direction is outbound, that is, from Data Access to the data source. An outbound direction indicates that the access control was either created directly in Data Access or initially imported from the data source but later edited in Data Access.

When the direction is outbound, Data Access pushes any access control that you create or edit in Data Access to the data source. Your changes are applied to the data source automatically. You do not need to manually start the synchronization or wait for the next scheduled synchronization. However, Data Access no longer pulls any further changes made to the access control in the data source, which ensures that your Collibra-defined rules remain intact.

With an outbound direction, you can manage access from a single place, which ensures that your data source always reflects the most current access control. We recommend outbound direction for access controls that support self-service access.

Partially managed in Collibra

This is a hybrid state in which you apply locking to specific parts of an access control. The Managed in field remains Collibra, but the access control is partially managed in Data Access and partially managed in the data source. You can edit the locked parts only through the API. We recommend the hybrid state for DevOps teams who want to manage access as code through Terraform.

Editing an imported access control

When you edit an imported access control:

The value in the Managed in field (in the Details sidebar on the access control page) changes from Data Source to Collibra.
The synchronization direction changes from inbound to outbound.
Data Access automatically pushes any further changes that you make to the access control in Data Access to the data source. However, Data Access no longer pulls any changes that you make to the access control in the data source.

Status of an access control

The status of an access control indicates whether it is in use in Data Access.

Status	Description
Active	The access control is enabled. It is applied to the data source during the next synchronization.
Inactive	The access control is disabled. It is not applied to the data source during the next synchronization. Any access that it gave in the data source is removed during the next synchronization.
Deleted	The access control is removed from the data source during the next synchronization.

Sync status of an access control

The synchronization status of an access control indicates whether the latest changes to an access control have reached your data source.

Sync status	Description
Synced	The access control is applied to the data source. No action is required.
Out of sync	A change to the access control, such as an edit, a deactivation, or a deletion, is waiting to be applied to the data source. The change is applied during the next synchronization.
Not connected	The access control is not yet applied to the data source. This sync status is expected for a newly created access control until its first synchronization. It also appears for an inactive access control whose access has already removed, and it remains that way until you reactivate the access control.
Sync error	The last attempt to apply the access control to the data source failed. The Issues tab on the access control page shows the error details. If the access control is linked to more than one data source, a failure in one data source is enough to show this sync status.