Skill: Enterprise Lakehouse Governance & Security

Description

Guides the agent in identifying sensitive data, extracting ETL lineage, and generating least-privilege IAM and RBAC policies for cloud storage and metadata catalogs (Unity Catalog, AWS Lake Formation).

Context

Lakehouses centralize an organization's data, making security and governance paramount. It is crucial to identify Personally Identifiable Information (PII), trace where data comes from (lineage), and ensure that roles accessing the lake have tightly scoped permissions.

Instructions

1. PII & Sensitive Column Detection

Analyze table schemas for column names that imply sensitive information.

• Target Keywords: email, ssn, phone, address, dob, credit_card, password, token, ip_address, health_record.
• Action: If sensitive columns are found, recommend applying column-level masking, Dynamic Data Masking (if supported), or replacing raw values with hashes.

Databricks Unity Catalog Masking Example:

CREATE MASKING FUNCTION email_mask(email STRING)
  RETURN CASE WHEN is_member('hr_role') THEN email ELSE '***@***.com' END;