Self-Service Sandboxes, Certified Data, Promotion, Ownership, and Access Boundaries

Learning outcomes

1. Sandbox freedom and certified trust serve different purposes

A sandbox is an exploratory space where analysts may create temporary transformations and hypotheses. Certified data is a published contract whose owner accepts responsibility for semantics, quality, freshness, security, documentation, and change. Naming a schema prod or adding “certified” to a table name is not certification.

2. Promotion is an evidence gate

required promotion evidence[ ] named owner and support path[ ] declared consumer/business decision[ ] declared grain and refresh/freshness contract[ ] dependencies point to governed facts/dimensions/metrics[ ] shared metric version/hash matches registry[ ] control totals reconcile at declared grain[ ] conformance tests pass for shared dimensions[ ] security/access class is reviewed and technically enforceable[ ] lineage and contract hash are recorded[ ] rollback/deprecation path exists[ ] no hidden filters, unit changes, or local redefinitions[ ] sandbox output is reproducible from versioned inputs

Not every organization needs these exact labels, but every promotion system needs equivalent evidence. The gate should be automatable where possible and explicitly reviewed where semantics/security require human judgment.

3. Controlled failure: convention-only promotion

The sandbox marketing table has a named owner and could be renamed into a production schema. Yet the lab deliberately fails three certification checks: metric reconciliation, metric-version pinning, and conformed-customer dependency. The correct outcome is BLOCK, even though the SQL executed successfully.

metric_reconciliation  FAIL  observed=665.00; expected=820.00metric_version         FAIL  gross_revenue_usd.v1 hash not pinnedconformed_customer     FAIL  team-local semanticsowner                  PASS  growth-analyticsaccess_class            PASS  marketing-certifiedDECISION: BLOCK

4. Repair without forbidding experimentation

The analyst can keep the 665 USD sandbox as an experiment if it is clearly named and scoped—for example non_sales_channel_paid_amount_experiment. To publish enterprise revenue, the repaired product joins the governed customer dimension and consumes the active revenue contract. The second promotion run passes every check.

metric_reconciliation  PASS  observed=820.00; expected=820.00metric_version         PASS  gross_revenue_usd.v1 hash pinnedconformed_customer     PASS  governed dim_customer dependencyowner                  PASS  growth-analyticsaccess_class            PASS  marketing-certifiedDECISION: CERTIFY

5. Ownership is operational responsibility

A certified owner answers: who receives failures, who approves breaking changes, who explains the metric, who reviews access, who communicates incidents, and who retires unused products? Ownership without a support/change process is only a label. Conversely, central platform teams should provide reusable certification tooling so domains are not forced to reinvent checks.

6. Access boundaries: metadata versus enforcement

The lab records finance-certified, marketing-certified, and operations-certified access classes. Those labels do not enforce anything by themselves. Production certification must prove that database roles, semantic policies, row/column filters, exports, service identities, and downstream caches implement the intended boundary. Chapter 22 goes deeper into these mechanisms.

7. Replay, promotion retries, and rollback

Promotion should be idempotent for the same artifact hash and dependency versions. A retry after a network/tool failure must not create a second differently named “certified” object with ambiguous status. Record promotion run ID, artifact/contract hash, test evidence, reviewer, dependency versions, and certification timestamp. Rollback means restoring the prior certified version and marking the failed version withdrawn/deprecated—not silently editing its historical evidence.

8. Production judgment

Sandboxes maximize learning speed; certification minimizes consumer ambiguity. Correctness: certify through semantic/control tests, not task success. Freshness: publish watermarks/SLOs. Security: prove enforcement, not labels. Observability: track promotion, failures, usage, ownership. Cost: stale unused certified tables create refresh/storage debt. Portability: schema/RBAC/catalog primitives vary by platform. Migration: promote new versions alongside old, move consumers, then deprecate.

9. Bridge to Lesson 5

Lesson 5 combines the chapter into one mart strategy: three domains, one shared governed core, domain-specific delivery, a sandbox path, and an acceptance suite that detects drift before certification.

Knowledge check

Authoritative references

• Kimball Group — Enterprise Data Warehouse Bus ArchitectureIncremental domain delivery integrated through reusable conformed dimensions.
• Kimball Group — Conformed DimensionsShared descriptive domains are defined once and reused to preserve analytical consistency.
• Kimball Group — Enterprise Data Warehouse Bus MatrixBusiness-process rows and dimension columns provide a planning and conformance map.
• Kimball Group — Differences of OpinionExplains why conformed facts/dimensions matter across distributed presentation marts.

10. Lab cleanup/reset

Delete atlasmart_ch21_lab (or your configured local output directory) and rerun python ch21_lab.py to recreate a clean deterministic state. No cloud resource or repository file is modified by the lab.