# Implementing Federated Governance in Data Mesh Architecture +
## 5 Implementing Federated Data Mesh Governance
### System Architecture  
In Figure 3, we provide a simplified view of the Fybrik platform. The core elements include the _FybrikApplication_ for registering and running the data workloads; a _Jupiter Notebook_, which is used by users manipulating the data assets; the data catalog for listing, linking, and search of the existing data products; policy manager and policy enforcement point (PEP) for providing security and compliance; and storage that can be represented as any supported platform--S3, PostgreSQL, etc.  
A FybrikApplication is a custom resource definition (CRD) submitted to the Kubernetes cluster where Fybrik is deployed. This CRD is required for defining how an application wants to access data, specifying the datasets it needs, the operations it intends to perform on the data, and any governance or compliance requirements that must be adhered to during data access and processing.  
The Fybrik control plane interprets this CRD request and orchestrates the necessary governance mechanisms, data access paths, and computational workload placements to ensure that the application's data access is compliant with the specified policies. This process may involve interfacing with data catalogs for metadata management, deploying  
Figure 3: Fybrik architecture.  
policy enforcement points (such as data masking), and selecting the optimal data storage and computing locations to satisfy performance, cost, and compliance considerations.  
Within Fybrik, the policy verification mechanism is based on the Policy Manager Connector. This manager ensures that data access and usage comply with the organization's policies and regulatory requirements. It acts as an intermediary between Fybrik and various policy management systems (e.g., chaincodes), enabling Fybrik to understand and enforce the governance rules applied to data operations. In order to use our _smart policies_ we implement the required _getPoliciesDecisions_ endpoint inside our connector.  
When the user code (e.g., notebook) requests access to a dataset through a FybrikApplication resource, Fybrik uses the policy connector to query the relevant chaincode for any policy decisions that apply to the requested operation. During this request, it transmits the context information such as data identifiers and intended asset use. Then smart policies process the request by comparing it to the defined rules (global standards or data contract), write the decisions to the ledger, and return the actions that the Fybrik platform has to apply (e.g., data masking).  
Within the Fybrik platform, the data catalogs are represented as plugin components. It uses the Data Catalog Connector to query these catalogs to retrieve metadata information about datasets. Therefore, it is possible to provide the custom catalog implementation. For being operable inside Fybrik, we define the connector app which supports four required operations over the metadata:  
* _createAsset_ is used for registering a new product, e.g when the user executes the notebook and the corresponding workload persists in the data;
* _getAssetInfo_ returns the metadata information which is used for product discovery, workload processing, etc;
* _updateAsset_ function updates any existing metadata records within the catalog;
* _deleteAsset_ is used for deleting the metadata about the product.  
Our metadata catalog and policy manager are based on the previously developed blockchain-powered metadata system [16]. The actual prototype was enhanced to also include policy management. The main components of our HLF-based governance system include the membership service provider with a certificate authority (CA) used for identifying and authorizing the parties, endorsement and ordering nodes for transaction processing (metadata, policy, or data contract processing), and channel configurations used for listing the participating domain and their rights.  
In the following, we provide an example of using the Hyperledger Fabric system.