Security and governance
This domain is about who can see and do what, and how you prove it.
Authentication and roles
Authentication is delegated. By default Cloud Pak for Data uses the IBM Cloud Pak foundational services identity provider; you can federate to LDAP/AD, SAML, or OIDC. Users get platform roles (Administrator, Editor, Viewer) and service-specific roles - a WKC Catalog Administrator, Data Steward, or Data Engineer; a Watson Studio project collaborator or viewer. Platform administrator does not automatically grant catalog administrator: grants are per service and per resource. API access uses Zen API keys bound to a user and inheriting that user's roles.
Governance in WKC
Core artifacts: catalogs (containers), governance categories (business hierarchy), business terms, data classes (patterns identifying sensitive data), reference data, policies, and rules. Data protection rules are the enforcement mechanism - deny, filter rows, mask, or restrict to a role - and they are evaluated when data is accessed through the platform. Data quality rules score assets; lineage traces transformations across connected tools.
Worked example
HR national ID numbers must be invisible to analysts querying a Watson Query virtual table. Create a data class with a regex for the ID format, add a business term and a governance category for PII, publish a data protection rule that masks the column for everyone outside the HR role, attach it to the catalog asset, then verify by querying as a non-HR user through Watson Query.
Traps
Confusing platform roles with service roles; assuming a rule masks data in the source database (it does not); forgetting that a rule only applies where the platform mediates access; adding catalog collaborators without checking their asset-level role.