Role-Based Access Control (RBAC) for Minimum Viable Data (MVD)

Calibo Accelerate uses Role-Based Access Control (RBAC) to secure the MVD lifecycle by ensuring that only authorized users can perform specific actions. RBAC establishes clear ownership, enforces governance, and maintains accountability throughout the MVD lifecycle.

The MVD workflow involves three product roles:

Data Scientist
Data Engineer
Product Owner

Each role has specific responsibilities and permissions within the MVD lifecycle. While all roles can view MVD specifications, validation results, version history, and audit logs, only authorized roles can perform lifecycle actions such as creating, configuring, validating, publishing, and approving MVDs.

MVD Roles and Responsibilities

Role	Responsibilities
Data Scientist	Create MVD specifications. Maintain and update MVD specifications. Create new specification versions. Define the dataset schema, data quality rules, anonymization rules, and filters. Review published Data Assets for reuse.
Data Engineer	Configure the MVD by defining the data source, data processor, and data target. Evaluate datasets against the MVD specification. Run MVD validation. Enrich metadata for validated datasets. Publish the MVD as a Data Asset or submit it for Product Owner approval.
Product Owner	Review and approve or reject publish requests. Transfer MVD ownership. Certify published Data Assets. Decertify or unpublish Data Assets when required. Govern published Data Assets to ensure they meet organizational standards.

Role

Responsibilities

Data Scientist

Create MVD specifications.

Maintain and update MVD specifications.

Create new specification versions.

Define the dataset schema, data quality rules, anonymization rules, and filters.

Review published Data Assets for reuse.

Data Engineer

Configure the MVD by defining the data source, data processor, and data target.
Evaluate datasets against the MVD specification.
Run MVD validation.
Enrich metadata for validated datasets.
Publish the MVD as a Data Asset or submit it for Product Owner approval.

Product Owner

Review and approve or reject publish requests.
Transfer MVD ownership.
Certify published Data Assets.
Decertify or unpublish Data Assets when required.
Govern published Data Assets to ensure they meet organizational standards.

MVD Permission Matrix

The following table summarizes the permissions available to each role.

Action	Data Scientist	Data Engineer	Product Owner
View MVD specifications	Yes	Yes	Yes
View validation results	Yes	Yes	Yes
View version history	Yes	Yes	Yes
View audit logs	Yes	Yes	Yes
Create MVD specification	Yes	No	No
Edit Draft MVD specification	Owner only	No	Yes (Override)
Delete MVD	Owner only	No	Yes
Delete MVD specification	Owner only	No	Yes
Clone MVD	Yes	No	No
Create a new specification version	Owner only	No	Yes (Override)
Configure MVD	No	Yes	No
Select dataset for validation	No	Yes	No
Run MVD validation	No	Yes	No
Attach metadata to a validated dataset	No	Evaluator only	No
Submit MVD for review	No	Evaluator only	No
Publish MVD directly	No	Yes	Yes (In case of role stacking)
Request MVD publication	No	Yes	No
Approve or reject publish requests	No	No	Yes
Transfer MVD ownership	No	No	Yes
Decertify a published MVD/Data Asset	No	No	Yes

Note:

Read access to the MVD is available to all product members.

MVD Lifecycle by Role

The following table summarizes which role is responsible for each stage of the MVD lifecycle.

Lifecycle Stage	Responsible Role
Create MVD specification	Data Scientist
Edit Draft specification	MVD Owner (Data Scientist)
Create new specification version	MVD Owner (Data Scientist)
Configure Data Source, Data Processor, and Data Target	Data Engineer
Validate MVD	Data Engineer
Review validation results	All roles
Submit MVD for approval	Data Engineer
Approve or reject publication	Product Owner
Publish as Data Asset	Data Engineer (owner) or Product Owner, depending on the publish path
Decertify published asset	Product Owner

Ownership Rules

The following ownership rules apply to MVD specifications:

The user who creates an MVD automatically becomes its owner.
Only users with the Data Scientist role can own an MVD specification.
Only the owner can create new specification versions.
The Product Owner can transfer ownership to another Data Scientist within the same product.
All ownership transfers are recorded in the audit logs.

Key RBAC Rules

Role / Responsibility	Rule
Data Scientist	Only Data Scientist can create and maintain MVD specifications.
Data Engineer	Only Data Engineers can configure and validate MVDs.
MVD Publishing	Only the Data Engineer who successfully configured and validated the MVD or a user with role stacking (Data Engineer + Product Owner) can publish it directly as a Data Asset. Other Data Engineers must submit a Request to Publish for Product Owner approval.
Product Owner	Only Product Owners can approve or reject publish requests
Ownership Management	Only Product Owners can transfer MVD ownership to another Data Scientist within the same product.
Data Asset Governance	Only Product Owners can decertify published Data Assets.
Audit and Compliance	All MVD lifecycle actions are automatically recorded in the MVD Audit Logs to support traceability, governance, and compliance.