Governance

Data governance has a reputation for being restrictive and slow — the review board that takes three weeks, the locked-down warehouse nobody can query. At Credible, we believe governance isn't achieved by locking things down. It's achieved by making the governed path the most powerful, reliable, and easiest way to work — so people choose it.

Our philosophy: make governance the path of least resistance.

Why Traditional Governance Fails

If the central data platform is slow, inflexible, or confusing, users route around it. When building a private spreadsheet is faster than waiting for the official dashboard, analysts abandon the central system — and the organization inherits data silos, inconsistent metrics, and mistrust in the numbers. Governance becomes a roadblock to bypass, not a guardrail for safety.

AI raises the stakes in both directions. An ungoverned agent pointed at raw data produces confident, wrong answers at scale. But a governed agent — one that answers through vetted semantic models, quickly and reliably — removes the reason to bypass governance at all. When the governed path is also the best path, good governance becomes the fastest way to get work done.

How Credible Governs

Governance in Credible isn't a policy document layered on top of the platform — it's built into how models are defined, published, accessed, and observed.

Definitions Live in Code

Business logic is defined once, in version-controlled Malloy models. Every dashboard, workspace chat, and AI-generated answer operates from the same verified source of truth — consistent metrics, relationships, and joins across the organization. Because the model is code, changes go through the same discipline as software: reviewed in pull requests, tested in CI, and traceable to an author.

Data Assets Have a Software Lifecycle

Models, data apps, and their manifest ship together as versioned packages. New versions publish atomically, data apps are versioned with the models they're built on, and auto-promote and auto-archive manage the version lifecycle — so updating logic never breaks downstream consumers mid-flight, and unused versions (and the materialized tables behind them) are cleaned up automatically.

Access Is Controlled at Every Layer

• Platform layer — Role-based permissions govern who can do what: environment roles (Admin, Modeler, Viewer) control modeling and publishing, while workspace and document sharing control analysis. See Permissions.
• Connection layer — Database credentials are stored once, in the environment, and never leave it. Modelers and developers SSO into Credible and work against managed connections — no credentials on laptops, no shared service accounts. Every query is proxied through Credible, access-checked, and logged. See Environments.
• Data layer — Row- and column-level security is defined in the model itself with #(authorize), secure givens, and field access modifiers — version-controlled, auditable, and enforced identically on every surface, from workspace chat to MCP agents to the REST APIs. See Access Control.

Because every consumer goes through the same semantic layer, there is exactly one enforcement point. There's no BI tool with its own permissions to drift out of sync, and no API path that skips the rules.

Everything Is Visible

Trust requires transparency. Because all consumption routes through the platform, Credible provides a single place to:

• Find the code that defines any metric
• Trace lineage from source database to final answer
• See who is querying what data, with an immutable audit trail for compliance
• Optimize the system from real usage — query cost and latency data guide materialization and caching decisions

This visibility feeds back into the model itself — real usage shows where definitions are missing, duplicated, or going unused, so the model keeps pace with the business rather than drifting out of date. See Platform Architecture for how this works.

Next Steps