Dynamic metadata policy
Reference for dynamic metadata policies in Atlan personas: how rule-based, connection-independent policies work, supported attributes and operators, rule limits, domain behavior, and current limitations.
A dynamic metadata policy grants a persona access to every asset that matches a metadata rule, across all connections in your Atlan workspace. You define the rule once, for example every asset in the Finance domain or every asset tagged PII, and Atlan resolves the matching assets for you. Assets that match the rule later, including assets from connections you add in the future, come into scope automatically.
This page is the reference for the policy model. For the step-by-step flow, see Create dynamic metadata policy.
Why dynamic metadata policies
A standard metadata policy is scoped to one connection. You pick the connection first, then select assets in it by browsing, searching, or adding rules. That works well for fine-grained control within a single source, but it doesn't scale to access that cuts across sources:
- A data domain that spans Tableau dashboards, Power BI reports, and Snowflake tables needs one policy per connection, all kept in sync by hand.
- Workspaces with dozens or hundreds of connections end up with one persona per connection as a workaround.
- Every new connection means revisiting every affected persona before its assets are accessible.
A dynamic metadata policy removes the connection from the policy. One rule covers all matching assets, one persona replaces many, and access keeps pace with ingestion without anyone editing policies.
How dynamic policies compare
| Standard metadata policy | Dynamic metadata policy | |
|---|---|---|
| Connection | Required. You select one connection per policy. | Not selected. The rule defines the scope. |
| Asset scope | Assets in the chosen connection, selected by hand or narrowed by rules | Every connection-backed asset that matches the rule |
| New assets | Covered only if they fall under the selected connection and asset selection | Covered automatically when they match the rule |
| New connections | Need a new policy | Covered automatically |
| Typical use | Fine-grained control within one source | One persona covering a domain, a sensitivity class, or a naming convention across many sources |
Both policy types can coexist on the same persona. Access is the union of every policy that grants it, and a deny always wins over a grant.
The Dynamic Metadata Policy option appears under New Policy only after an admin turns on the Labs toggle Allow dynamic metadata policies in personas. See Enable Labs toggle.
How dynamic policies work
A dynamic metadata policy stores your rule, not a list of assets. When a user acts on an asset, Atlan evaluates the rule against that asset's metadata to decide whether the policy applies. As a result:
- Tagging a table with
PIItomorrow brings it under an existingPIIpolicy immediately. - Moving an asset into a domain, or out of it, changes the user's access with no policy edit.
- Assets from a connection created after the policy was saved are covered as soon as they're ingested, if they match the rule.
Dynamic metadata policies govern connection-backed assets only: tables, columns, views, dashboards, reports, pipelines, and other assets that belong to a connection. Glossary terms, data domains, data products, and other objects that don't belong to a connection have their own access model and aren't governed by dynamic metadata policies, even when a rule might otherwise match them.
Rule structure
Each rule has three parts:
- Attribute: the asset property to evaluate, such as Domains or Tags.
- Operator: how to compare, such as is one of or starts with.
- Value: one or more values to compare with.
Add up to 3 rules per policy and choose how they combine:
- Match all: an asset must satisfy every rule. Use this to narrow scope, for example tagged
PIIand schema qualified name starts withdefault/snowflake/prod. - Match any: an asset needs to satisfy only one rule. Use this to widen scope, for example in the Finance domain or in the Treasury domain.
The limit counts rules, not values. A single is one of rule accepts many values, so one Tags rule listing five tags stays within the limit.
If three rules can't express what you need, split the intent across several policies on the same persona. Access is the union of all policies that grant it.
Supported attributes
| Attribute | What it matches | Operators |
|---|---|---|
| Domains | Assets in one or more data domains, including their subdomains and data products. See Domain rules. | is one of, isn't |
| Tags | Assets carrying one or more Atlan tags, for example PII or Confidential. You can also match on tag values. | is one of, isn't |
| Asset type | Assets of one or more types, such as Table, Column, or Dashboard. Most useful under Match all to narrow a broader rule. | is one of, is, isn't |
| Schema qualified name | Assets whose schema qualified name matches, for example every asset under default/snowflake/1700000000/analytics/reporting. | equals, isn't, starts with, ends with |
| Database qualified name | Assets whose database qualified name matches, for example every asset in databases named finance_*. | equals, isn't, starts with, ends with |
| Properties → Qualified name | Assets whose own qualified name matches a pattern. Use starts with to scope to a connection or a hierarchy. | equals, isn't, starts with, ends with |
For how Domain and Asset type rules behave, including why rules don't propagate from a table to its columns and how rules combine across policies, see Domain and asset type rules.
Match the operator to the shape of your value. Use is one of for lists and equals or starts with for single text values.
Domain rules
Domain membership in Atlan is recorded in two ways. An asset can be placed directly in a domain, or it can belong to a domain through a data product. A dynamic metadata policy with a Domains rule covers both:
- Assets placed directly in the selected domains.
- Assets placed directly in any subdomain of the selected domains.
- Assets that belong to any data product under the selected domains or their subdomains.
Atlan expands the selected domains into this full set of subdomains and data products when you save the policy.
Because the expansion happens at save time, subdomains or data products you create after saving aren't covered until you reopen the policy and save it again. Make this part of your process whenever you add a subdomain or a data product to a governed domain.
Domain rules match assets that carry the domain, not their children. If a table is assigned to the Finance domain but its columns aren't, a Finance domain rule covers the table and not the columns. See Current limitations.
Permissions
A dynamic metadata policy grants the same set of permissions as a standard metadata policy: read, update, and governance actions on assets, custom metadata, tags, terms, and related objects. By default, all permissions are granted. To restrict them, edit the permissions when you create the policy. For the full list, see Configure permissions.
You can also turn the policy into a deny rule. A deny overrides any grant for the same users, across every persona they belong to. Use deny sparingly, and prefer narrowing the grant rule instead.
Examples
One persona for a cross-source domain. A governance persona covering everything in the Marketing domain, whether it lives in Snowflake, Tableau, or Power BI.
Match all
Domains is one of Marketing
Permissions: all
Read-only access to sensitive tables. An analyst persona that can view, but not change, anything classified as personal data.
Match all
Tags is one of PII
Asset type is one of Table, View
Permissions: read
Scope to production across every warehouse. A persona that sees production schemas only, regardless of which connection they belong to.
Match all
Schema qualified name ends with /prod
Permissions: read
Exclude a staging layer. A broad grant that skips raw landing databases.
Match all
Database qualified name starts with default/snowflake
Database qualified name is not default/snowflake/1700000000/bronze
Permissions: read
Behavior differences to know
Saving takes a few seconds longer. A dynamic metadata policy resolves assets across all connections rather than one, so saving takes a few seconds longer than a standard metadata policy. This is expected.
Assets outside the policy can still appear in search. Assets that a dynamic metadata policy doesn't grant access to may still show up in search and discovery with restricted visibility, marked with a lock icon. Users can see that the asset exists but can't open its details. Connection-scoped policies hide such assets entirely.
Changes apply immediately. Every user and group linked to the persona inherits a new or edited policy as soon as it saves. There is no propagation delay for metadata changes on assets, because the rule is evaluated when access is checked.
Current limitations
No SDK or API support. Dynamic metadata policies can be created and edited only in the Atlan UI. There is no pyatlan method, Java SDK method, or documented REST API for them.
Access doesn't propagate to child assets. Access granted on a parent asset doesn't flow down to its children. A rule that matches a table because of its tag or domain doesn't match the table's columns unless those columns carry the same tag or domain. Scope your rule to the assets you want to cover, and combine it with tag or domain propagation in Atlan where appropriate.
Data Quality. If Data Quality is enabled on your workspace, rule-based policies aren't shown in the UI. Confirm with Atlan Support whether this affects your workspace before planning around dynamic metadata policies.
Personas with stale policies. Avoid adding a dynamic metadata policy to a persona that has inactive policies, or policies on connections that were later deleted. This edge case can cause the new policy to fail to save.
Non-connection assets aren't covered. Glossary terms, data domains, data products, and other objects that don't belong to a connection aren't governed by dynamic metadata policies. Use the access controls specific to those objects instead.
Not every access boundary is a metadata boundary. If the assets you want to group don't share a domain, tag, or naming convention, use a standard metadata policy for that connection. Both policy types can coexist on one persona.
Troubleshooting
Users don't get the access you expect. Check whether any other persona the same users belong to contains a deny that covers the asset, since deny always wins. Then confirm the persona is enabled and has the users or groups assigned.
Domain rule misses assets in a new subdomain or product. Reopen the policy and save it again so the domain expansion picks up the new structure. See Domain rules.
Policy option isn't available under New Policy. Confirm the Labs toggle Allow dynamic metadata policies in personas is on, then reload the personas page. If Data Quality is enabled on your workspace, rule-based policies aren't shown.
Save appears to hang. Wait for the save to complete rather than retrying. If you do retry, search for the policy by name first, because a second save with the same name is rejected as a duplicate.
Related
- Create dynamic metadata policy: Step-by-step flow, including enabling the Labs toggle.
- Metadata policy: Connection-scoped metadata policies and the full permissions list.
- Create persona: Set up the persona that holds your policies.
- Domains: Organize assets into domains and subdomains.