DataHub Compliance Posture (DHCP)

DHCP gives governance evidence an address. It maps DataHub metadata to evidence for AICM, GDPR, HIPAA, ISO 27001/42001, and SOC 2, then safely writes approved context back without grading compliance.

Comment

Inspiration

I was inspired by the intersection of data, agents, ML/AI, governance, and compliance. Organizations already invest heavily in data catalogs, ownership, lineage, classification, and metadata, but that context is often disconnected from the people assembling audit evidence or reviewing governance obligations.

I wanted to explore a practical question: what if an agent could turn DataHub metadata into useful supporting evidence without pretending to certify compliance?

That question became DataHub Compliance Posture, or DHCP. The name is intentional: DHCP gives governance evidence an address.

What it does

DHCP inspects a defined DataHub catalog boundary and generates a scoreless Supporting Evidence Package. It reports what metadata was observed, what was not observed, which datasets were involved, why the evidence may be relevant, and what it cannot establish.

DHCP currently evaluates catalog observations such as:

  • Dataset descriptions
  • Domain assignments
  • Field-level sensitivity labels
  • Lineage relationships
  • Ownership assignments
  • Retention intent
  • Backup-requirement decisions

These observations are mapped to selected objectives from:

  • CSA AI Controls Matrix
  • GDPR
  • HIPAA
  • ISO/IEC 27001
  • ISO/IEC 42001
  • SOC 2

DHCP does not grade compliance, certify readiness, or determine that a control is satisfied. It produces bounded supporting evidence for human review.

The output includes a branded Posture Brief with raw counts, percentages, and named dataset gaps, plus a detailed Markdown and JSON evidence package containing exact observed and not-observed asset populations, deterministic criteria, framework interpretations, limitations, and provenance.

DHCP also supports human-reviewed write-back. When structured metadata is missing, it can create targeted DataHub Forms for exact datasets. A reviewer selects an approved value, previews the proposed operation, and explicitly applies it. DHCP then independently reads the result back from DataHub before reporting success.

How we built it

I built DHCP in Python around DataHub OSS 1.6 and its GraphQL API.

The deterministic evidence layer reads DataHub metadata and produces exact dataset counts and partitions. A LangChain-based agent can interpret and explain the evidence, but it does not calculate compliance scores or override deterministic observations.

Framework mappings are maintained as versioned YAML evidence profiles. Each mapping identifies the DataHub observations that may contribute evidence, explains their relevance, states their limitations, and identifies the DataHub surfaces where a reviewer can inspect the metadata.

The project includes:

  • DataHub GraphQL integrations
  • Deterministic catalog observations
  • Versioned YAML evidence profiles
  • A LangChain-based agent workflow
  • A schema-validated report payload rendered as Markdown, JSON, and HTML
  • Cryptographic binding between evidence artifacts
  • DataHub Document publication
  • DataHub Forms assignment and completion
  • Dry-run-first Structured Property write-back
  • Independent post-write read-back
  • A lightweight local review UI
  • OpenTelemetry tracing
  • Jaeger trace visualization
  • Prometheus and Grafana operational dashboards
  • A reproducible Docker Compose judge environment
  • Synthetic healthcare and AI datasets designed to exercise the complete workflow

The synthetic showcase includes training, validation, inference, clinical, consent, claims, reporting, and patient-related datasets. It demonstrates meaningful differences in documentation, ownership, classification, retention, backup decisions, and lineage without using real patient or customer data.

The optional LangChain analysis agent uses DataHub Agent Context Kit tools for a bounded, read-only context lookup. Its narrative is validated before inclusion and cannot alter deterministic observations, counts, or evidence populations.

The repository also includes a project-local /dhcp DataHub Skill.

During the hackathon, I submitted a separate reusable governance-evidence skill to the upstream DataHub Skills project.

Challenges we ran into

The largest product challenge was deciding what DHCP should claim. Compressing nuanced metadata into framework scores would look more authoritative than the underlying evidence justified, so DHCP uses deterministic observations, exact asset populations, and explicit claim boundaries instead.

DataHub OSS also exposed several integration challenges. Missing GraphQL entities can return different response shapes depending on the entity type. Default-valued aspects can be omitted from read-back responses. Search indexing is asynchronous, so a successful mutation may be visible through a direct read before appearing in search.

I normalized these behaviors, added bounded indexing barriers, and preserved the important cases as regression tests.

DataHub OSS 1.6 does not include every governance interface available in DataHub Cloud. Assigned Forms can appear on datasets, but OSS does not provide the full Cloud Task Center experience. I created a deliberately local demo UI for reviewing requests, previewing submissions, applying confirmed values, and displaying verified receipts. It is clearly identified as unauthenticated demonstration infrastructure and is not intended for public deployment.

Framework mapping presented another challenge. I needed to contribute useful evidence without reproducing licensed framework text or implying that metadata satisfies an entire control. Every included objective was reviewed against the evidence DHCP actually collects.

Finally, safe write-back required more than submitting a mutation. DHCP validates the exact report, target dataset, Form, prompt, Structured Property, allowed value, and current remote state. It defaults to dry-run, requires explicit application, and independently verifies the final value.

Accomplishments that we're proud of

I am proud that DHCP evolved into a more credible evidence product instead of a compliance grader.

Key accomplishments include:

  • A scoreless evidence model with explicit claim boundaries
  • Six evidence profiles spanning major security, privacy, and AI governance frameworks
  • Exact observed and not-observed dataset populations
  • A concise Posture Brief backed by a detailed evidence package
  • Cryptographically bound Markdown and JSON artifacts
  • Human-reviewed DataHub Forms and Structured Property write-back
  • Dry-run, explicit apply, and independent read-back for mutations
  • A synthetic catalog that demonstrates realistic governance use cases
  • A reproducible, pinned DataHub OSS judge environment
  • Privacy-conscious OpenTelemetry traces and aggregate operational dashboards
  • Fail-closed validation across report publication, Forms, write-back, and UI boundaries
  • Extensive automated testing across supported Python versions
  • An upstream DataHub governance-evidence skill contribution with DataHub MCP support, six framework profiles, 22 explicit mappings, deterministic Markdown/JSON output, and isolated OSS validation

I am especially proud that the evidence package remains useful even when the agent or optional narration is unavailable. The core results are deterministic and reproducible.

About the builder

I built DHCP through Obsidian Tek, drawing on more than 20 years across engineering, cloud, cybersecurity, and compliance. My professional certifications include CISSP, PECB Senior Lead SOC 2 Manager, CCSK, and CCZT. Connect with me on LinkedIn and follow Obsidian Tek on LinkedIn.

DHCP produces supporting catalog evidence only. It is not legal advice, an audit, an attestation, a certification, or a compliance determination.

What we learned

I learned that governance metadata becomes much more valuable when it is treated as reusable evidence rather than a collection of isolated catalog fields.

A lineage edge can support review of documented data flows, but it does not prove that every flow is complete. A retention property can document intent, but it does not prove that the period is legally appropriate or that deletion occurred. A sensitivity label can support classification review, but it does not establish that classification is complete or correct.

Making those distinctions visible produced a stronger product.

I also learned that human review and automation do not need to be opposing choices. An agent can identify an exact evidence gap, prepare a bounded request, and validate the resulting metadata while leaving the accountable decision with a person.

Finally, I learned how much DataHub context can be composed across ownership, domains, descriptions, tags, glossary terms, lineage, Forms, Documents, and Structured Properties. Together, those surfaces provide a strong foundation for evidence collection and governance workflows.

What's next for DataHub Compliance Posture (DHCP)

The next step is to validate DHCP across additional DataHub environments and make its evidence-generation and human-review workflows easier to deploy, operate, and extend without weakening its scoreless, dry-run-first, and independent read-back safeguards.

After the hackathon, I would like to add:

  • Authenticated review and approval workflows
  • Change-over-time evidence comparisons
  • Additional framework evidence profiles
  • More DataHub-native automation and workflow integrations
  • Policy-aware dataset scoping
  • Additional evidence sources beyond catalog metadata
  • Configurable organization-specific Structured Properties
  • Historical evidence and write-back receipts
  • Deeper support for AI training, validation, and production-data boundaries
  • Integrations with governance, risk, compliance, and audit platforms

The long-term goal is to make governance evidence easier to locate, understand, review, and improve while keeping people accountable for the decisions that metadata alone cannot make.

Built With

Share this project:

Updates