Quiz: Data Governance and Cataloging

Twelve questions. Answers with explanations follow the questions — work through them before scrolling.

1. §30.1 offers a single test for whether a governance artifact is worth maintaining. What is it?

• A. Whether it is required by a compliance framework
• B. Whether it is complete
• C. What decision it changes
• D. Whether anyone has read it in the last quarter

2. Kestrel assigned the internal status tier by directory rather than by judgment. What did this achieve?

• A. It reduced the number of tables in the warehouse
• B. It took a search from ~4,000 results to ~600 without anyone making 3,400 decisions
• C. It satisfied an audit requirement
• D. It prevented analysts from querying staging models

3. §30.4 says an owner must satisfy three conditions. Which is not one of them?

• A. The owner is a team, not an individual
• B. The owner is able to act on the thing they own
• C. The owner has been verified recently
• D. The owner wrote the original model

4. Kestrel had 62 identities with access to gold and 23 that had queried it in 90 days. Which conclusion does that gap not support on its own?

• A. Some grants are unnecessary
• B. The access review has not been removing grants
• C. 39 grants should be revoked
• D. Reviewing against usage would produce different decisions than reviewing against a list

5. Case Study 1 found four definitions of active_customer. What resolved a three-week dispute in about four minutes?

• A. Choosing the definition with the largest count
• B. Choosing the definition owned by the most senior stakeholder
• C. Asking which definition had already been stated to someone outside the company
• D. Averaging the four definitions

6. Three of Case Study 1's eleven implementations were renamed rather than reconciled. What test identified them?

• A. Which ones were used most often
• B. What decision each number is used for
• C. Which ones were newest
• D. Which ones had an owner

7. §30.6 says classification propagates directionally. What does that mean?

• A. A model's classification is inherited from its downstream consumers
• B. A model that reads confidential data is at least as sensitive as its source; a model cannot declassify by reading
• C. Classification flows from the catalog to the warehouse
• D. Classification is set once at ingestion and never changes

8. §30.7 says a retention policy needs three things. Which is the one most often missing?

• A. A period
• B. A mechanism that enforces it
• C. An exception path
• D. An owner

9. Case Study 2's test for whether an access review is real:

• A. Whether it completes on time
• B. Whether a manager signs it
• C. Whether the reviewer's answer could have been "no"
• D. Whether it covers every role

10. Case Study 2 inverted the review default from "tick to approve" to "tick to keep." What made that acceptable in practice?

• A. Reviewer training
• B. A documented, pre-authorized path that restores a previously-held grant in minutes
• C. Reducing the number of roles first
• D. Extending the review window to 400 days

11. §30.9 claims the 84 crowd-sourced "gotchas" are the most-read text in Kestrel's catalog, and notes they are the only part not written by each model's author. Why does that matter?

• A. Authors are usually too busy to write documentation
• B. An author cannot write down the thing they find obvious
• C. Authors write in technical language users do not understand
• D. Authors are not permitted to edit the catalog

12. Case Study 1's gross_margin was computed two ways, one including shipping cost. It was well-formed, complete, timely, and internally consistent — and wrong for seven months. What does this demonstrate?

• A. That the data quality register was incomplete
• B. That the freshness monitors were misconfigured
• C. That a disagreement between two pieces of code about what a word means is not a property of any table, and no assertion can detect it
• D. That the contract in Chapter 17 should have covered it

---

Answers

1 — C. What decision it changes.

§30.1's test, and the reason most governance artifacts should not exist. A field that changes no decision costs maintenance forever and returns nothing; the honest response is to delete it. Compliance requirements (A) sometimes force artifacts that fail this test — §30.12 covers that case — but the test is still the right one to apply first. Completeness (B) is not a virtue on its own: a complete catalog of things nobody decides with is complete and worthless.

2 — B. It took a search from ~4,000 results to ~600 without anyone making 3,400 decisions.

The point is the cost of the decision, not the accuracy of the tier. Staging models live in a known directory, are not intended for direct consumption, and marking them internal mechanically removes most of the noise from search. Exercise 30.2 asks about the risk: some models in that directory are intended for consumption, and the mechanical rule mislabels them. The mitigation is that the tier is a default, overridable per model — a cheap wrong answer you can correct beats an expensive right one nobody makes.

3 — D. The owner wrote the original model.

Authorship is a fact about the past. §30.4's three conditions are: a team (individuals leave — 34 of Kestrel's 290 owners no longer resolved), able to act (an owner who cannot change the thing is a name, not an owner), and verified recently (an unverified owner field decays silently). Original authorship correlates with none of the three, which is why it is the field most catalogs record and the one that helps least.

4 — C. 39 grants should be revoked.

The gap is a finding, not a decision. Kestrel's 39 included four legitimately idle users — a quarterly analyst, an auditor, and two seasonal merchandisers — who would have been removed by an automatic rule and whose access was correct. The gap tells you the review has work to do; it does not do the review. A, B, and D all follow from the gap alone.

5 — C. Asking which definition had already been stated to someone outside the company.

The question works because it is not an argument about merit (nobody has to concede their definition is worse), it has an objectively checkable answer, and it correctly identifies the definition with the highest cost of change. It is the same move as §26.8's pre-decided "stale over wrong": finding a decision that has already been made rather than making a new one. When it returns nothing — no definition has left the building — you are back to a genuine decision, which is fine, because you have eliminated the easy case in four minutes.

6 — B. What decision each number is used for.

§30.1's test applied to a metric. The 30-day-any-event definition serves a churn model whose prediction horizon is 30 days; migrating it to the certified 12-month definition would have degraded a production model to satisfy a naming convention, and the first draft of the reconciliation plan proposed exactly that. Reconcile the implementations that answer the same question; rename the ones that do not. A metric-governance project that produces one definition of everything has usually destroyed something, and the destruction is invisible because the thing it broke still runs.

7 — B. A model that reads confidential data is at least as sensitive as its source.

Sensitivity flows downstream and cannot be reduced by a SELECT. A model can be less sensitive than its source only through a deliberate, documented transformation — aggregation past a threshold, tokenization, suppression — and that reduction is a decision someone makes and records, not a property that emerges. The common failure is a "safe" aggregate that is not: a count by postcode and age band that identifies one person is as sensitive as the row it came from.

8 — B. A mechanism that enforces it.

A period without a mechanism is a sentence in a document. Kestrel had documented 3-year retention on clickstream and 4.19 TB/year of it in S3 with no lifecycle rule — the policy was real, believed, and enforced by nothing. The exception path (C) is the second most-missed: without one, the first legitimate legal hold becomes an argument about whether to violate the policy, and the policy loses.

9 — C. Whether the reviewer's answer could have been "no."

An attestation asks do you approve this?; a review asks here is evidence; what should change? Kestrel's spreadsheet satisfied its compliance requirement for eight consecutive quarters and produced zero removals — and zero removals across two years is itself the finding nobody was looking at. This is Chapter 23 Case Study 2's "measure whether a control is operating, not whether it exists," arriving in a fourth department.

10 — B. A documented, pre-authorized path that restores a previously-held grant in minutes.

Inverting a default moves the cost of being wrong from one side to the other; it does not remove it. The inversion was acceptable because restoration became trivially fast — any of four people, no ticket. Without that, the objection ("you will remove access somebody needs") would have been correct, and the review would have been resented and routed around. The general principle: before inverting a default, make recovery from the new default's mistakes cheaper than recovery from the old one's. The 400-day window (D) and the role reduction (C) both helped, but neither addresses the objection.

11 — B. An author cannot write down the thing they find obvious.

This is why author-written descriptions systematically omit exactly the information a new user needs. The gotchas were written by whoever answered a real question, in the words the asker used, which also makes them findable by the next person with the same question. The mechanism costs the answerer one emoji reaction, and it produces a ranked backlog for free: the questions asked most often are the entries most worth writing.

12 — C. A disagreement between two pieces of code about what a word means is not a property of any table.

Both implementations were internally consistent, correctly typed, complete, and fresh. There is no assertion over a table's contents that reveals the divergence, because the defect is not in the data — it is in the agreement between two definitions. Three things detect it: a grep, a semantic layer where the definition exists once, or two numbers meeting in a meeting. Only the first two are a plan. This is the strongest available argument for a semantic layer, and it is not the usual one: the usual argument is consistency-as-tidiness, and the real one is that this defect class is invisible to every other control in this book.