Quiz: The Medallion Architecture

Twelve questions. Answers with explanations follow — work through them first.

1. §34.1 evaluates three claims made for the medallion architecture. Which one does the chapter say is the real value?

• A. It separates concerns
• B. It improves data quality
• C. It makes debugging tractable, by converting an unbounded search into a binary search
• D. It reduces storage cost

2. Bronze carries _ingested_at, _source_file, _batch_id, and _row_number. Why is that not a violation of source fidelity?

• A. They are small columns
• B. They describe the arrival, not the record — the envelope, not the letter
• C. Fidelity applies only to values, not to columns
• D. They are removed before silver

3. §34.3's test for whether an operation belongs in silver or gold:

• A. Whether it changes the row count
• B. Whether it is expressible in SQL
• C. Whether two competent people could disagree about the answer
• D. Whether it is reversible

4. A source sends quantity = -1 for a return. Turning that into an is_return flag belongs in:

• A. Bronze, since it is source-specific
• B. Silver, since it is a type conversion
• C. Gold, because deciding that -1 means "return" is an interpretation of the source's convention
• D. It does not matter

5. gold.fct_session trips both layer-skip and cast-in-gold. What should you do?

• A. Suppress both, since they describe one model
• B. Fix the cast, which is the simpler change
• C. Fix the layer-skip; the cast is a mechanical consequence and will disappear
• D. Split the model in two

6. §34.5 classifies a missing grain as a warning and backflow as blocking. What is the test?

• A. How hard the violation is to fix
• B. If this is violated, is any number wrong?
• C. How many models are affected
• D. Whether the violation is visible to a consumer

7. §34.6: which assertion legitimately belongs at two layers?

• A. Uniqueness of the primary key
• B. Not-null on a required column
• C. A row count — because the bronze and silver versions fail for opposite reasons
• D. Referential integrity

8. Replaying a corrupt bronze.customers_raw costs $102.00; a corrupt gold.daily_revenue costs $0.96. A full rebuild of all seventeen models costs $198.96. §34.9 draws which conclusion?

• A. Bronze corruption should be prevented at any cost
• B. Rebuilding is cheap enough to do quarterly as an exercise, not to fix anything
• C. Gold models should be materialized as views
• D. The layers are too expensive to maintain

9. bronze.customers_raw reaches 47% of the graph; gold.daily_revenue reaches nothing. §34.10 proposes:

• A. Test only high-blast-radius models
• B. Test breadth by blast radius, test depth by visibility
• C. Move high-blast-radius models to gold
• D. Reduce blast radius by duplicating tables

10. silver.stg_order_enriched is at depth 3 while every other silver model is at depth 1. Why is this diagnostic more robust than the backflow rule that also catches it?

• A. It runs faster
• B. It tests the graph's shape rather than its labels, so it survives mislabelling and renaming
• C. It produces fewer false positives
• D. It works without a dependency graph

11. §34.13: nobody decides to put a business rule in silver. What is the mechanism, and what is the fix?

• A. Poor training; fix with documentation
• B. The shortcut is four lines and doing it properly is a new model, an owner, and a test — and nothing ever revisits working code. Fix: the shortcut must fail the build
• C. Unclear layer definitions; fix with a clearer spec
• D. Reviewer inattention; fix with a checklist

12. §34.14 gives three conditions under which you should not adopt the medallion architecture. Which is the one the chapter calls "the honest one"?

• A. One source, one consumer, no conformance problem
• B. A pure streaming platform where the log is raw
• C. When you will not enforce it
• D. When storage cost is prohibitive

---

Answers

1 — C. It makes debugging tractable.

"Separates concerns" is true and vague. "Improves data quality" is false as stated — layers do not improve quality, Chapter 23's assertions do; layers provide somewhere to put a check where it means something. The real value is the three-question binary search: wrong in gold but right in silver is a business rule, one model, usually one line; wrong in silver but right in bronze is a type, a dedup, or a key; wrong in bronze is not your bug, and you can prove it — which is a statement you can only make if you kept what the source sent.

2 — B. They describe the arrival, not the record.

The test: could the source system have sent it? If yes, it is data and must be faithful. If no — if it is a fact about your pipeline — it is envelope and it belongs. Each of the four answers a question you will be asked: when we received it, which file it was in, which run produced it (the unit of deletion that makes idempotency achievable), and what order it arrived in (needed to break a dedup tie deterministically).

3 — C. Whether two competent people could disagree.

Nobody disagrees that "142" is 142. People do disagree about what -1 means, about whether an empty string is a null, and about what timezone an offsetless timestamp is in. The moment they can disagree, the decision needs an owner, a name, and a place in gold where it is visible. The cost is asymmetric: a business rule in silver is invisible to its owner and gets rediscovered during an audit, while a conformance rule in gold is merely repetitive — so when unsure, push it up.

4 — C. Gold.

Deciding that the source's -1 convention means "return" is an interpretation, even though it is obviously correct. This is the case that took Kestrel a real argument, and the resolution was that obviousness is not the test — disagreement-possibility is. Note what this buys: the rule now has an owner who can change it when the supplier changes their convention, and a name that appears in the catalog.

5 — C. Fix the layer-skip.

The model reads bronze directly, and because bronze is untyped it must therefore cast. The second finding is a mechanical consequence of the first, and a rule set that surfaces one boundary violation from two angles is working as designed — you may only be looking from one of them. Kestrel's first attempt suppressed both warnings by adding the casts to a permitted list, which left both boundary violations in place and removed the second signal. If fixing the blocking finding does not make the warning disappear, you had two problems, which is also useful to know.

6 — B. If this is violated, is any number wrong?

A blocking rule breaks a property the graph depends on: backflow makes the graph uncomputable from raw, mutable bronze destroys replay, a silver model with no key does not deduplicate so every downstream count is wrong. A warning harms a reader — a missing grain will cause a wrong join, which is a real cost, but the numbers are still right and blocking a deploy on it teaches the team to disable the check. The test is crude, defensible in review, and has kept the blocking set small enough that nobody has asked to turn it off, which is the only measure of a lint rule that matters.

7 — C. A row count.

Bronze asserts "today's file has between 5,000 and 9,000 order rows" — a statement about the source, detecting a truncated export or a source outage. Silver asserts "stg_orders gained 5,000–9,000 rows and the count equals bronze minus duplicates" — a statement about the transformation. They look identical and fail for opposite reasons: when bronze's fires the source is wrong; when silver's fires, you are. The general test: two assertions are duplicates if they fail for the same reason, not if they compute the same number.

8 — B. Rebuilding is cheap enough to do quarterly as an exercise.

$198.96 is less than a single erasure request from unpartitioned bronze Parquet (Chapter 31), and Chapter 1's broken job cost 19× a full rebuild every night. So Kestrel rebuilds everything quarterly not to fix anything but to confirm it still can — and the exercise has failed three times in two years, finding a vendor that corrected history in place, a gold model depending on a hand-made table no lineage tool knew about, and a non-deterministic dedup. None of the three is detectable by any assertion, because each is a property of the whole graph over time rather than of a table's contents.

9 — B. Test breadth by blast radius, test depth by visibility.

Test effort is normally allocated by how interesting a model is, which is close to backwards: bronze.customers_raw is a trivially simple load that can invalidate 47% of the graph, and gold.daily_revenue is the most business-critical table in the platform and can invalidate nothing. The counter-argument is fair — a daily_revenue defect is seen by the CEO at 06:15 and a customers_raw defect is seen by nobody until it propagates. Those are different risks, reach versus visibility, and the resolution uses both.

10 — B. It tests the graph's shape rather than its labels.

The rule depends on the layer field being correct. The depth calculation depends only on dependency edges, so it survives a model being mislabelled, moved, or renamed — and it would still have flagged the model if someone had "fixed" the violation by relabelling it as gold. It is also more persuasive: a rule violation is a tool asserting that something is against policy, and policy is arguable, whereas a stg_ model at depth 3 is a self-evident contradiction. Measure the property, not the declaration — the same move as reviewing access against usage (§30.12) and diffing features row-by-row (§32.7).

11 — B. The shortcut is four lines, and nothing revisits working code.

The sequence is: someone needs a flag urgently; the data is already joined and typed in a staging model; adding one CASE WHEN is four lines while doing it properly is a new model, a grain statement, an owner, and a test; the four-line version ships and works; nothing ever revisits it because it is not broken. Every step is locally reasonable. This is the same ratchet as Chapter 25's alerts, Chapter 30's grants, and Chapter 33's idle warehouses — the shortcut has a requester and a deadline, the correction has neither. The fix is not discipline: the shortcut must fail the build, with an expiring suppression as the escape hatch. Nine of Kestrel's eleven suppressions were resolved, seven in the week their expiry approached.

12 — C. When you will not enforce it.

Three directories with no rules give you the storage cost, the compute cost, and the latency cost of the pattern and none of the debugging benefit, because you cannot trust that a silver table is deduplicated or that a bronze table is faithful. A and B are legitimate structural reasons — silver is a pass-through with one source, and a long-retention log can be bronze — but C is the one the chapter calls honest, because it is the common case and it is a decision about your team rather than about your architecture. One well-tested transformation layer beats three untrusted ones.