Skip to Content
GovernanceOverview

Governance

Governance in Zeotap provides the controls you need to manage who can access what data, where data can flow, and how your organization enforces compliance policies. It covers role-based access control, data flow restrictions, row-level data filtering, and multi-workspace management.

What Is Governance?

As your CDP usage grows — more team members, more destinations, more sensitive data — you need controls that go beyond simple authentication. Zeotap’s Governance features let you:

  • Control access — Define who can see and modify which resources using roles and permissions
  • Mask sensitive data — Set column-level sensitivity labels that control PII visibility in previews, suggestions, and syncs
  • Restrict data flow — Set rules that prevent sensitive data from reaching unauthorized destinations
  • Filter data visibility — Create access policies that automatically apply row-level filters based on user group membership
  • Erase data on request — Define audience-scoped deletion rules that remove data from your warehouse on a schedule, with an audit log of every run
  • Manage at scale — Organize multiple workspaces under a single organization with centralized member management
  • Track every change — See who changed which piece of configuration, what the value was before, and when

Governance Features

Role-Based Access Control (RBAC)

Zeotap provides a fine-grained permission system with three built-in roles and 86 permissions across 32 resource categories. Permissions are additive — a member’s effective permissions are the union of their role’s permissions.

  • Owner — Full access to everything, including workspace management and billing
  • Admin — Full access to all resources except workspace deletion and ownership transfer
  • Member — Basic read and write access to operational resources (sources, models, syncs)

Learn more:

  • RBAC Overview — How the permission model works
  • Roles — Built-in role definitions and comparison
  • Permissions — Complete permission reference (86 permissions, 32 categories)
  • Groups — Organize members for easier management
  • Managing Members — Invite, modify, and remove members

PII Masking

PII masking provides column-level sensitivity controls that determine how personal data is exposed across the platform. Mark columns as redacted (masked in UI, syncable), sync-only (hidden in UI, syncable), or blocked (hidden everywhere, not syncable). Includes automatic PII detection by column name patterns and SHA256 hash-on-sync for ad platform audience matching.

See PII Masking for configuration details.

Destination Policies

Destination policies control which data can sync to which destinations and under what conditions. Use them to:

  • Block specific data from reaching certain destinations (e.g., prevent PII from syncing to advertising platforms)
  • Transform data before it leaves the warehouse (e.g., hash email addresses before syncing to ad platforms)
  • Rate limit sync frequency to specific destinations (e.g., limit syncs to a partner API to once per day)

See Destination Policies for configuration details.

Access Policies

Access Policies provide row-level access control. Define SQL filter conditions that automatically apply to all queries when a user belonging to a specific group accesses data. Use access policies to:

  • Restrict regional teams to their own data (e.g., “EMEA only” access policy)
  • Limit partner access to specific customer audiences
  • Enforce data sovereignty requirements

See Access Policies for examples and configuration.

AI Policies

AI policies — guardrails — decide what the AI agent may do in the workspace on its own, what it must have a human approve first, and what it may never do. Rules match on the tool being called, how often it is called, the columns in a filter, or the destination being written to. New workspaces start with two of them switched on, holding deletions and sync triggers for approval.

They live on the AI Policies page in this section, and are documented under Guardrails.

Deletion Rules

Deletion rules erase data for a population you define — the same filter language as an audience — across one or more models in your warehouse, on demand or on a schedule. Use them to:

  • Fulfil GDPR right-to-erasure and CCPA deletion requests at scale, instead of deleting identifier by identifier
  • Delete whole rows, or clear only the personal columns on rows that must survive
  • Keep an auditable log of every run: records affected per model, the exact statements issued, and who ran it

Every rule starts in observe mode, reporting what it would delete without changing anything.

See Deletion Rules for the eligibility rules, safety controls, and what the feature deliberately does not cascade.

Audit Log

The workspace audit log records every change to your workspace’s configuration — the person who made it, the resource they touched, and the exact fields that moved, with their values before and after. It covers changes made through the app and the REST API, and can be filtered, downloaded as CSV or JSON, or emailed to your team. (Changes the AI agent makes through its own tools are not yet recorded there; its tool calls appear in the AI Audit Log instead.)

See Audit Log for what is recorded and how to export it.

Organizations

Organizations let you manage multiple Zeotap workspaces under a single umbrella. Centralize member management, apply consistent governance policies, and maintain visibility across all workspaces from a single admin view.

See Organizations for setup instructions.

How Governance Fits into the Platform

Organization containing workspaces with governance features

Governance features are workspace-scoped:

  • RBAC (roles, permissions, groups) applies within a workspace
  • Destination policies are defined per workspace
  • Access Policies are defined per workspace and assigned to groups
  • AI policies constrain the AI agent within the workspace that defines them
  • Audit log entries are workspace-scoped and readable by owners and admins
  • Organizations provide a cross-workspace management layer

API Reference

Govern resources are managed through the Zeotap REST API. Policies, groups and members are workspace-scoped, so their paths carry your workspace ID as {id}; organizations sit above workspaces and are keyed by {orgId} instead. See Base URL for your instance’s API base URL and Authentication for the required Authorization and X-Workspace-ID headers.

# Destination Policies
GET    /api/v1/workspaces/{id}/destination-rules
POST   /api/v1/workspaces/{id}/destination-rules
PUT    /api/v1/workspaces/{id}/destination-rules/{ruleId}
DELETE /api/v1/workspaces/{id}/destination-rules/{ruleId}
 
# Deletion Rules — run/dry-run return 202 with the opened run; the
# deletion continues past the request, so follow it through the log
GET    /api/v1/workspaces/{id}/deletion-rules
POST   /api/v1/workspaces/{id}/deletion-rules
PUT    /api/v1/workspaces/{id}/deletion-rules/{ruleId}
DELETE /api/v1/workspaces/{id}/deletion-rules/{ruleId}
POST   /api/v1/workspaces/{id}/deletion-rules/{ruleId}/dry-run
POST   /api/v1/workspaces/{id}/deletion-rules/{ruleId}/run
GET    /api/v1/workspaces/{id}/deletion-rules/{ruleId}/runs
GET    /api/v1/workspaces/{id}/deletion-runs
 
# Access Policies
GET    /api/v1/workspaces/{id}/subsets
POST   /api/v1/workspaces/{id}/subsets
PUT    /api/v1/workspaces/{id}/subsets/{subsetId}
DELETE /api/v1/workspaces/{id}/subsets/{subsetId}
 
# Groups
GET    /api/v1/workspaces/{id}/groups
POST   /api/v1/workspaces/{id}/groups
PUT    /api/v1/workspaces/{id}/groups/{groupId}
DELETE /api/v1/workspaces/{id}/groups/{groupId}
 
# Members — a member's role is the only thing you change, so the
# update call targets the role directly
GET    /api/v1/workspaces/{id}/members
POST   /api/v1/workspaces/{id}/members/invite
PUT    /api/v1/workspaces/{id}/members/{accountId}/role
DELETE /api/v1/workspaces/{id}/members/{accountId}
 
# Audit Log
GET    /api/v1/workspaces/{id}/audit-log
GET    /api/v1/workspaces/{id}/audit-log/filters
GET    /api/v1/workspaces/{id}/audit-log/export
POST   /api/v1/workspaces/{id}/audit-log/email
 
# Organizations
GET    /api/v1/organizations
POST   /api/v1/organizations
PUT    /api/v1/organizations/{orgId}

See the API Reference for full request/response schemas.

Best Practices

  • Start with least privilege — Assign the Member role by default and escalate to Admin or Owner only when needed.
  • Use groups for team management — Instead of managing permissions per user, create groups that map to your team structure and assign access policies and roles at the group level.
  • Layer destination policies early — Set up destination policies before connecting sensitive destinations. It’s easier to relax restrictions later than to discover sensitive data was already synced.
  • Document your governance model — Keep a record of which groups exist, what access policies they have, and why. This helps with compliance audits and onboarding new team members.
  • Review access regularly — Periodically audit member lists, role assignments, and destination policies to ensure they still reflect your organization’s needs. The Audit Log filtered to the role, member and group resource types is the fastest way to run this review.

Next Steps

Last updated on
IncidentsPII Masking