Skip to main content

14.3 — Spaces as Security Boundaries

1. Why spaces matter​

A Datasphere space is more than a folder.

It can represent:

  • data ownership;
  • security boundary;
  • workload boundary;
  • storage allocation;
  • integration boundary;
  • development responsibility;
  • sharing boundary.

2. Space access model​

The simplified model is:

TENANT | +-- SPACE A | +-- USERS | +-- OBJECTS | +-- DATA | +-- SPACE B +-- USERS +-- OBJECTS +-- DATA

A user assigned to one space does not automatically receive access to another space.

3. Designing space topology​

Common patterns:

Domain spaces​

FINANCE PROCUREMENT SALES HR

Good when domain ownership and access boundaries align.

Platform-layer spaces​

RAW CURATED SEMANTIC

Useful for technical separation but can become difficult if business ownership is weak.

Hybrid​

DOMAIN | +-- acquisition +-- preparation +-- semantic

Use only when the additional boundary solves a real governance or security problem.

4. Space versus role​

Do not use spaces as a replacement for roles.

The space answers:

Where is the data and who is responsible for it?

The role answers:

What can this person do?

5. Cross-space sharing​

Sharing creates an intentional bridge between security boundaries.

Before sharing, ask:

  • What object is being shared?
  • Who owns it?
  • Who consumes it?
  • Is the shared object reusable?
  • Does the receiving space gain more access than intended?
  • How will changes be governed?

6. Production topology​

A mature enterprise may separate:

  • development;
  • test;
  • production;

through tenant or lifecycle architecture, while also using domain-oriented spaces inside each environment.

Do not automatically create a space for every team. Every boundary introduces operational overhead.

7. Space administrator boundary​

A space administrator can manage important aspects of the assigned space, including security-related responsibilities.

Therefore, assigning space administrator authority is a meaningful trust decision.

8. Space design checklist​

For every space document:

  • owner;
  • purpose;
  • data classification;
  • users;
  • roles;
  • source connections;
  • consumers;
  • storage;
  • workload profile;
  • sharing relationships;
  • security controls;
  • audit requirements;
  • lifecycle path.

Architect exercise​

Design spaces for a multinational company with:

  • Finance;
  • Sales;
  • Procurement;
  • HR;
  • central enterprise data;
  • regional restrictions.

Defend every boundary and every cross-space dependency.