How access controls sync
In Data Access, an access control is defined independently of how your data source enforces it. Each access control synchronizes in only one direction:
- Inbound: From the data source to Data Access.
- Outbound: From Data Access to the data source.
The synchronization (sync) direction depends on whether the access control is managed in the data source or in Collibra.
Source of an access control
Every access control has a Managed in field, which defines the source of truth. It shows which system owns the access control: the data source or Collibra Data Access. Consequently, it determines the direction of data flow. This prevents permissions from being unintentionally overwritten.
Access control managed in data source (inbound)
If the Managed in field in an access control is Data Source, the access control already existed in your data source and was imported into Data Access.
When an access control is managed in the data source, each time that the data source is synchronized, Data Access pulls any changes that are made to the access control in the data source. This gives you immediate visibility into your current setup, and it does not require you to recreate access controls in Data Access. You can see who has access to what directly in Data Access.
An inbound access control is read-only in Data Access until you internalize it.
Access control managed in Collibra (outbound)
If the Managed in field in an access control is Collibra, the access control was either created in Data Access or imported and later internalized in Data Access.
Data Access automatically pushes any access control that you create or edit to the data source. You do not need to manually start the sync or wait for the next scheduled one.
When an access control is managed in Collibra, Data Access no longer pulls any changes that are made to the access control in the data source. This ensures that your Collibra-defined rules remain as you set them.
An outbound access control lets you manage access from a single place, so your data source always reflects the most current access control.
Partially managed in Collibra
This is a hybrid state in which the Managed in field in an access control remains Collibra, but the access control is partially managed in Data Access and partially managed in the data source. This happens when you lock specific parts of the access control, such as its beneficiaries, name, or ownership. Those locked parts continue to be imported from the data source. You can edit the locked parts only through the API.
Internalizing an access control
An access control that is managed in the data source is read-only in Data Access until you internalize it. Internalizing makes Data Access the authoritative source of the access control.
After you internalize an access control:
- Changes that you make to the access control in Data Access are automatically pushed to the data source.
- Changes that are made to the access control in the data source are no longer pulled to Data Access. Data Access overwrites those changes during the next sync.
- The Managed in field value in the access control changes from Data Source to Collibra.
Internalizing is permanent and cannot be undone. Imported column masks and row filters cannot be internalized. Groups can be internalized only if the data source supports group editing.
Status of an access control
The status of an access control shows whether it is in use in Data Access.
| Status | Description |
|---|---|
| Active |
The access control is enabled. It is pushed to the data source during the next sync. |
| Inactive |
The access control is disabled. It is not pushed to the data source during the next sync. Any access that it gave in the data source is removed during the next sync. |
| Deleted |
The access control is removed from the data source during the next sync. |
Sync status of an access control
The sync status of an access control shows whether the latest changes to the access control have reached your data source.
| Sync status | Description |
|---|---|
| Synced |
The access control is pushed to the data source. No action is required. Access controls that are still managed in the data source also show Synced. |
| Out of sync |
A change to the access control, such as an edit, a deactivation, or a deletion, is waiting to be pushed to the data source. The change is pushed during the next sync. |
| Not connected |
The access control is not yet pushed to the data source. This sync status is expected for a new access control until its first sync. It also appears for an inactive access control whose access has already removed, and it remains that way until you reactivate the access control. |
| Sync error | The last attempt to push the access control to the data source failed. The Issues tab in the access control shows the error details. If the access control is linked to more than one data source, a failure in one data source is enough to show this sync status. |
How the sync status changes
When you create, edit, activate, deactivate, or delete an access control, Data Access automatically starts a sync to push the change to the target data source. Until the sync finishes, the Sync status field in the Details sidebar shows Not connected (for an access control that has never been synchronized) or Out of sync (for an access control that was changed since its last sync). If the sync succeeds, the sync status changes to Synced. If it fails, the sync status shows Sync error.
When you add an unowned entity to your access control, it is not immediately added. Instead, an access request is generated and assigned to the entity owners. If an owner implements the request, the entity is added to your access control. When this happens, the sync status of your access control changes to Out of sync until Data Access pushes the change to the data source. After that, the sync status returns to Synced.