Skip to main content
Community Hub

Create dynamic metadata policy

TL;DR

Create a dynamic metadata policy in Atlan to grant a persona access across every connection with a single metadata rule, instead of one policy per connection.

Your AI can read this via Docs MCPcurl -fsSL "https://docs.atlan.com/install-docs-mcp" | bashConnect

Create a dynamic metadata policy to grant a persona access with a single metadata rule that applies across every connection, instead of adding one policy per connection. A regular metadata policy requires you to pick a connection first, so covering a domain that spans Tableau, Power BI, and SQL tables means one policy per source. A dynamic metadata policy drops the connection requirement: you define a rule on metadata such as domains, tags, or qualified names, and every asset that matches is in scope, no matter which connection it came from. New assets that match the rule are covered automatically as they're ingested.

Prerequisites​

  • You are an admin in Atlan, or you have the Governance Admin sub-role.
  • The Labs toggle Allow dynamic policies in personas is enabled for your tenant (see the next section).
  • You have a persona to add the policy to, or you create one as part of this flow.
  • You know the metadata rule that identifies the assets you want to cover, for example a domain, a tag, or a qualified name pattern.

Enable Labs toggle​

The dynamic metadata policy option is hidden until an admin turns it on in Labs.

  1. In your Atlan workspace, click Settings from the left menu.

  2. Open Labs, then find the Allow dynamic policies in personas toggle and enable it.

Where Labs lives

In the new UI, the Labs toggles for personas are grouped under Settings → Personas. If you don't see Labs, ask an admin to enable it, or contact Atlan Support.

  1. Reload the personas screen so the new policy type appears.

Create dynamic metadata policy​

  1. Go to your persona: from Settings, open Personas, then open an existing persona or create a new one.

  2. Switch to the Policies tab, then click New Policy.

  3. Choose Dynamic Metadata Policy.

Unlike a standard metadata policy, this policy type doesn't ask you to select a connection. The rule you define is what scopes the policy.

  1. Under Name, briefly describe the policy's intention, for example, Marketing domain: read-only across all sources.

  2. Define the rule that selects the assets in scope. Add up to 3 rules and choose how they combine:

    • Match all: an asset must satisfy every rule to be in scope.
    • Match any: an asset only needs to satisfy one of the rules.

    Each rule has an attribute (for example, Domains, Tags, or a qualified name), an operator (for example, is one of, equals, starts with), and one or more values. For the full list of supported attributes and operators, see Dynamic metadata policies in the metadata policy reference.

    Example: to cover every asset in the Marketing domain, set Attribute to Domains, Operator to is one of, and Value to Marketing.

  3. (Optional) Under Configure permissions, click Edit to choose which permissions the policy grants. By default, all permissions are granted.

  4. (Optional) Under Deny selected permissions, choose whether the policy must explicitly deny these permissions instead of granting them.

    Deny overrides every grant

    If enabled, this denial overrides grants from any other policy for the same users, across every persona they belong to.

  5. Click Save.

    Saving takes a little longer

    A dynamic metadata policy resolves assets across all connections rather than one, so it takes a few seconds longer to save than a standard metadata policy. This is expected.

Every user and group linked to the persona inherits the policy immediately. As new assets that match the rule are ingested, they come into scope automatically without any manual update.

Current limitations​

Dynamic metadata policies are in preview. Keep these constraints in mind:

  • Data Quality: if Data Quality is enabled on your tenant, rule-based (ABAC) policies aren't shown in the UI. Confirm with Atlan Support whether your tenant is affected before you plan around this policy type.
  • Personas with stale policies: avoid creating a dynamic metadata policy on a persona that already has inactive policies, or policies created on connections that were later deleted. This edge case can cause the policy to fail.
  • Re-create early test policies: if you created dynamic metadata policies while the feature was first being rolled out, create fresh ones rather than reusing the old ones.
  • No SDK or API support yet: dynamic metadata policies can currently be created only through the UI. There is no pyatlan or API method for them.
  • Access doesn't propagate to children: access granted at a parent level (for example, a domain) doesn't automatically flow down to child assets. Scope your rule to the assets you actually want to cover.

Need help?​

If a dynamic metadata policy isn't granting access the way you expect, first check whether any other persona the same user belongs to has a deny rule, since deny always wins. Then confirm the Labs toggle is still enabled and that Data Quality isn't hiding rule-based policies on your tenant. If you still need help, contact Atlan Support.

Next steps​