Skip to main content

14.8 — Security Troubleshooting, Labs & Architect Exercises

1. Troubleshooting decision tree​

When access fails:

USER CANNOT ACCESS | v AUTHENTICATED? /
NO YES | | IDENTITY ROLE? | v SPACE? | v PRIVILEGE? | v OBJECT? | v DAC? | v CONSUMPTION?

Never change a role blindly before identifying the failing layer.

2. User cannot see a space​

Check:

  1. user exists;
  2. role assignment;
  3. scoped role;
  4. space scope;
  5. role privileges;
  6. assignment propagation;
  7. current environment.

3. User sees the space but cannot edit​

Likely layers:

  • object privilege;
  • operation privilege;
  • role composition;
  • object ownership or lifecycle restriction.

4. User can see metadata but not expected rows​

Investigate:

  • Data Access Control;
  • authorization criteria;
  • identity value;
  • permission entity;
  • hierarchy authorization;
  • privileged-role behavior.

5. User sees too much data​

Treat as a security incident.

Do not merely add another filter.

Check:

  • unrestricted role;
  • DAC configuration;
  • exposed object;
  • sharing path;
  • consumer behavior;
  • cached or previously exposed data;
  • authorization changes.

6. Hands-on labs​

Lab 1 — Least privilege​

Design roles for five personas and test positive and negative permissions.

Lab 2 — Space isolation​

Create a multi-domain space topology and document cross-space sharing.

Lab 3 — Row-level security​

Build a region-based DAC model.

Lab 4 — Hierarchy authorization​

Design organizational hierarchy-based access.

Lab 5 — Privileged access​

Test how broad privileges affect data-level restrictions.

Lab 6 — Audit review​

Create a security review evidence pack.

Lab 7 — Access incident​

Diagnose a user who unexpectedly gained access.

Lab 8 — Access incident​

Diagnose a user who unexpectedly lost access.

Lab 9 — Consumer security​

Validate the complete SAC consumption path.

Lab 10 — Enterprise architecture​

Design security for a global Datasphere platform.

Architect exercise​

For each incident, produce:

  • symptom;
  • authorization layer;
  • evidence;
  • root cause;
  • immediate fix;
  • permanent fix;
  • preventive control;
  • owner.

That is the expected architect-level troubleshooting format.