Federated Access for Governed Data Queries

What Is Federated Access in Data Architecture?数据架构中的联邦访问是什么？

This focused article is part of the federated queries and data virtualization guide; use the pillar guide to compare related concepts, methods, and implementation decisions across the full topic.

本文是联邦查询与数据虚拟化指南内容集群中的专题文章；如需比较完整主题下的相关概念、方法与实施决策，请返回基石指南。

Federated access is the controlled ability to query data across autonomous sources while each source retains ownership, local policy, and operational boundaries. A federated layer authenticates the requester, evaluates purpose and entitlements, limits the query, obtains only approved data, and records how the result was produced.

联邦访问是在各来源保留所有权、本地策略和运维边界的前提下，受控查询自治数据源的能力。联邦层验证请求者、评估目的与权限、限制查询、仅获取获批数据，并记录结果如何生成。

This is not a page about SAML or OIDC single sign-on. Identity federation may supply an authenticated subject, but data access additionally requires authorization, source-level enforcement, row and column rules, masking, lineage, retention, and audit. A valid login is never sufficient evidence that a cross-source query is allowed.

本页不是SAML或OIDC单点登录指南。身份联邦可以提供已验证主体，但数据访问还需要授权、来源级执行、行列规则、脱敏、血缘、保留和审计。成功登录从来不能单独证明跨源查询被允许。

Build the Federated Access Control Path建立联邦访问控制路径

Subject and purpose主体与目的

Resolve the human or service identity, tenant, role, approved purpose, device or workload context, and session risk. Reject missing or contradictory context.

解析人员或服务身份、租户、角色、获批目的、设备或工作负载上下文及会话风险，拒绝缺失或矛盾信息。

Policy decision策略决策

Combine global rules with source obligations. Decide allowed sources, views, fields, rows, operations, time windows, result size, and export behavior.

组合全局规则与来源义务，决定可访问来源、视图、字段、行、操作、时间窗口、结果规模和导出行为。

Policy enforcement策略执行

Apply restrictions in the virtual layer and, where possible, again at each source. Fail closed when policy, identity, or source capability cannot be verified.

在虚拟层执行限制，并尽可能在每个来源再次执行。无法验证策略、身份或来源能力时应关闭访问。

Evidence and audit证据与审计

Record requester, purpose, policy version, sources, query plan, fields, filters, decisions, observation times, bytes, result limits, and exceptions.

记录请求者、目的、策略版本、来源、查询计划、字段、过滤、决策、观察时间、字节、结果限制和例外。

Keep policy decision and policy enforcement separate. The central layer may decide that a field is allowed, but the connector and source must prove they can enforce the required row filter, masking rule, and query limit. If a source cannot honor a control, the planner must remove that field or reject the request rather than apply an approximate substitute. Version policy bundles and retain the evaluated inputs so a later reviewer can reconstruct why access was granted.

应分离策略决策与策略执行。中央层可以决定某字段允许访问，但连接器和来源必须证明能够执行所需行过滤、脱敏规则与查询限制。来源无法满足控制时，规划器必须移除该字段或拒绝请求，而不是采用近似替代。应对策略包进行版本管理并保留评估输入，使后续审查者能够重建授权原因。

Choose an Identity Propagation Model选择身份传递模式

Access identity models访问身份模式
Model模式	Strength优势	Risk to control需控制风险
End-user delegation终端用户委派	Source sees the real requester and can apply local policy来源看到真实请求者并可执行本地策略	Token scope, audience, lifetime, delegation chain, connector support令牌范围、受众、寿命、委派链和连接器支持
Service identity服务身份	Simpler connection pooling and stable source account连接池更简单，来源账户稳定	Virtual layer must enforce user policy and retain attribution虚拟层必须执行用户策略并保留归属
Brokered temporary credential代理临时凭据	Short-lived, scoped access with explicit issuance evidence短期、限域访问并具备明确签发证据	Broker trust, revocation, clock skew, source integration代理信任、撤销、时钟偏差和来源集成

Do not choose a model only because the connector supports it. Select the model that preserves least privilege, source policy, attribution, revocation, and operational reliability for the actual data sensitivity.

不能仅因为连接器支持某种模式就选择它。应根据实际数据敏感度，选择能够保持最小权限、来源策略、归属、撤销和运维可靠性的模式。

Delegation also changes incident response. With end-user identity, revoking one person may stop new source sessions directly; with a pooled service identity, the federated layer must terminate that person’s active work without disrupting other users. Test credential expiry, audience mismatch, clock skew, token replay, connector reconnection, and policy changes during a long query. Never place reusable source credentials in query text, client logs, exported notebooks, or browser storage.

委派模式也会改变事件响应。使用终端用户身份时，撤销个人权限可直接阻止新的来源会话；使用池化服务身份时，联邦层必须终止该用户的活动工作而不影响其他人。应测试凭据过期、受众不匹配、时钟偏差、令牌重放、连接器重连和长查询期间策略变化。不得把可复用来源凭据放入查询文本、客户端日志、导出Notebook或浏览器存储。

Keep Federated Authorization No Broader Than Source Policy确保联邦授权不宽于来源策略

Map global roles to explicit source entitlements rather than copying group names blindly. Similar labels can have different meanings across domains. Resolve conflicts with the stricter rule unless a documented exception is approved by the accountable owner. Row filters, column denial, masking, purpose restrictions, and export limits must survive joins and derived fields.

应把全局角色映射到明确的来源权限，而不是盲目复制组名。相似标签在不同域可能含义不同。冲突应采用更严格规则，除非责任人批准有记录的例外。行过滤、列拒绝、脱敏、目的限制和导出限制必须在连接及派生字段后继续有效。

Derived data can be more sensitive than either input. A join may reveal identity, health status, financial condition, or membership even when each source exposes only permitted attributes. Classify the resulting view and apply disclosure controls to aggregates, small groups, repeated queries, downloads, and downstream caches.

派生数据可能比任何单一输入都更敏感。即使每个来源仅暴露获准属性，连接也可能揭示身份、健康状态、财务状况或成员关系。应对结果视图重新分类，并对聚合、小群体、重复查询、下载和下游缓存实施披露控制。

Apply policy after transformation as well as before it. A permitted birth date may become a disallowed age band; a permitted postal code and purchase history may identify a household; an aggregate may expose a person when the group is small. Define minimum group sizes, suppression, rounding, query budgets, and review rules for derived attributes. Tag sensitive transformations in lineage so downstream tools inherit the correct handling requirements.

策略既要在转换前执行，也要在转换后执行。获准出生日期可能变成不允许的年龄段；获准邮编与购买历史可能识别家庭；小群体聚合可能暴露个人。应定义最小群体规模、抑制、取整、查询预算和派生属性审查规则，并在血缘中标记敏感转换，让下游工具继承正确处理要求。

Operate Approval, Change, Revocation, and Exception Paths运营批准、变更、撤销与例外路径

Register the use case. Record owner, purpose, sources, fields, users, retention, exports, risk, and expiry.登记用例。记录负责人、目的、来源、字段、用户、保留、导出、风险和到期时间。
Confirm source approval. Each source owner reviews semantics, legal basis, policy, load, and permitted disclosure.确认来源批准。每个来源负责人审查语义、法律依据、策略、负载和允许披露。
Implement least privilege. Prefer approved views and narrow credentials; set row, column, query, time, and result limits.实施最小权限。优先使用获批视图和限域凭据，并设置行、列、查询、时间和结果限制。
Validate effective access. Test allowed and denied users, boundary rows, masked fields, joins, exports, and source failures.验证有效访问。测试允许和拒绝用户、边界行、脱敏字段、连接、导出和来源故障。
Monitor and review. Alert on unusual volume, denied attempts, policy drift, stale approvals, shared credentials, and unexpected exports.监控与审查。针对异常量、拒绝尝试、策略漂移、过期批准、共享凭据和意外导出告警。
Revoke completely. Remove virtual grants, source mappings, cached data, exports, sessions, tokens, and scheduled jobs; retain required audit evidence.彻底撤销。移除虚拟授权、来源映射、缓存数据、导出、会话、令牌和计划任务，并保留所需审计证据。

Exceptions need an expiry, compensating controls, and evidence of closure. An emergency grant should name the incident, approving owner, exact fields, maximum result size, allowed destination, monitoring rule, and automatic revocation time. Review source and virtual grants together after reorganizations, acquisitions, role changes, or policy updates. A removed dashboard does not prove that credentials, scheduled queries, caches, or exports were removed.

例外必须有到期时间、补偿控制和关闭证据。紧急授权应说明事件、批准人、确切字段、最大结果规模、允许目的地、监控规则和自动撤销时间。组织调整、并购、角色变化或策略更新后，应同时审查来源与虚拟授权。删除仪表盘不能证明凭据、计划查询、缓存或导出已经删除。

Test Federated Access as an End-to-End Control把联邦访问作为端到端控制进行测试

A policy-engine unit test is not enough. Run the same query as an allowed user, a denied user, a user from another tenant, an expired user, and a service account. Test missing claims, stale group membership, connector fallback, source policy changes, cached results, partial failure, large exports, and a query that derives protected information from otherwise allowed fields.

仅测试策略引擎单元并不够。应让允许用户、拒绝用户、另一租户用户、过期用户和服务账户执行同一查询。测试缺失声明、过期组成员关系、连接器回退、来源策略变化、缓存结果、部分故障、大规模导出，以及从原本允许字段推导受保护信息的查询。

Verify evidence, not only the visible answer. The audit trail must connect the requester to the policy decision, effective source identities, executed plan, source objects, filters, observation times, released fields, and result destination. Attempt cancellation and revocation while a query is active. Confirm that errors and logs do not reveal denied data.

不仅验证可见答案，还要验证证据。审计轨迹必须把请求者与策略决策、有效来源身份、已执行计划、来源对象、过滤、观察时间、发布字段和结果目的地关联。查询进行时测试取消和撤销，并确认错误与日志不会泄露被拒绝数据。

Create a small, frozen authorization test corpus with synthetic users, tenants, records, and expected decisions. Run it after every policy, connector, schema, identity, or planner release. Include negative tests that attempt wildcard selection, hidden-column inference, joins through unapproved keys, nested queries, function calls, temporary tables, cached-result reuse, and export to a different destination. Treat an unexpected allow as a release blocker, not a minor defect.

建立一个小型、冻结的授权测试语料，包含合成用户、租户、记录和预期决策，并在每次策略、连接器、Schema、身份或规划器发布后运行。负向测试应尝试通配选择、隐藏列推断、通过未批准键连接、嵌套查询、函数调用、临时表、缓存结果复用，以及导出到不同目的地。意外允许必须作为发布阻断项，而不是轻微缺陷。

Measure control quality over time: denied-query rate, stale grants, review completion, exception age, policy-evaluation latency, missing lineage, unattributed source sessions, sensitive export volume, and revocation completion. Investigate trends with owners; do not optimize denial rate downward without understanding whether users are confused, compromised, or attempting work outside approved scope.

持续衡量控制质量，包括拒绝查询率、过期授权、审查完成率、例外年龄、策略评估延迟、缺失血缘、无法归属的来源会话、敏感导出量和撤销完成度。应与负责人调查趋势，不能在不了解用户是否困惑、账户是否受损或工作是否超出范围时，盲目降低拒绝率。

Use InfiniSynapse Within Approved Federated Access在获批联邦访问范围内使用InfiniSynapse

Prepare approved source connections, accountable owners, effective permissions, shared definitions, join keys, privacy constraints, freshness expectations, query limits, and validation examples. Use InfiniSynapse for the supported cross-source analysis. Do not treat the analysis workspace as proof that every source policy, identity delegation path, cache, or downstream export is automatically governed.

请准备获批来源连接、责任人、有效权限、共享定义、连接键、隐私约束、新鲜度期望、查询限制和验证样例，并使用InfiniSynapse完成受支持的跨源分析。不要把分析工作区视为所有来源策略、身份委派路径、缓存或下游导出均已自动治理的证明。

Analyze only the sources and fields approved for the task仅分析该任务获批的来源与字段Open the analysis workspace打开分析工作区

Federated Access FAQ联邦访问常见问题

What is federated access in data architecture?

数据架构中的联邦访问是什么？

It is governed cross-source data access in which autonomous sources retain ownership and local controls while an approved requester receives only the rows, columns, operations, and results permitted for a defined purpose.

它是受治理的跨源数据访问：自治来源保留所有权和本地控制，而获批请求者仅获得针对明确目的所允许的行、列、操作和结果。

Is federated access the same as single sign-on?

联邦访问等同于单点登录吗？

No. Single sign-on establishes an authenticated identity. Federated data access must also authorize the query, preserve source policy, restrict rows and columns, control derived results, and produce lineage and audit evidence.

不等同。单点登录建立已验证身份；联邦数据访问还必须授权查询、保留来源策略、限制行列、控制派生结果，并生成血缘和审计证据。

Should the source see the end-user identity?

来源是否应该看到终端用户身份？

End-user delegation gives the source stronger attribution and local policy enforcement, but not every connector supports it. A service identity can be acceptable only when the federated layer reliably enforces user policy and retains attribution.

终端用户委派能提供更强归属和本地策略执行，但并非所有连接器都支持。只有联邦层可靠执行用户策略并保留归属时，服务身份才可接受。

What happens when source policies conflict?

来源策略冲突时怎么办？

Use the stricter effective rule unless accountable owners approve a documented exception. Never widen access silently to make a cross-source join succeed.

除非责任人批准有记录的例外，否则应采用更严格的有效规则。不能为了让跨源连接成功而悄然扩大访问。

What should a federated access audit record contain?

联邦访问审计应记录什么？

Record requester, purpose, policy version, effective identities, sources, objects, fields, filters, query plan, decisions, observation times, result limits, exports, exceptions, and revocation events.

记录请求者、目的、策略版本、有效身份、来源、对象、字段、过滤、查询计划、决策、观察时间、结果限制、导出、例外和撤销事件。

Official and Primary Sources官方与第一方来源

Access behavior varies by engine, connector, and identity model. Verify policy semantics, delegation, caching, audit coverage, and revocation against the deployed version and your legal obligations.

访问行为因引擎、连接器和身份模式而异。请针对部署版本和法律义务验证策略语义、委派、缓存、审计覆盖和撤销。