HR Access Governance in the Data Lake

1. Overview

This challenge assesses your ability to implement role-based Data Fabric security for HR data in the Data Lake. You will:

1. Generate an EmployeeData schema from a sample CSV file and upload the data through Atlas.
2. Create the HRANALYST and HRDEPTMANAGER security roles and profiles.
3. Configure page, feature, and data access, including object-level and property-level restrictions.
4. Control access to sensitive fields such as salary and hire date.
5. Export the HRDEPTMANAGER profile as JSON for validation.

Throughout, apply the principle of least privilege.

Learning Objectives

• Understand the three layers of Data Fabric security: Page Access, Feature Access, and Data Access.
• Configure role-based access to Data Fabric pages and features.
• Implement object-level and property-level data restrictions.
• Create reusable security profiles for organizational roles.

Business Scenario

You are the Data Fabric administrator at Global Corp, where HR data from multiple departments flows into the Data Lake. The compliance team requires role-based access controls so that employees can access only the data appropriate to their responsibilities. You will configure security profiles for different organizational roles while meeting data governance requirements.

Prerequisites

Naming convention: Replace [YOUR INITIALS] with your own initials wherever it appears.

2. Guided Tutorial

Part 1. Create the Employee Data Schema

Use the Data Catalog Generate from Sample Data feature to create the schema automatically.

1.1 Download the sample file

Download employee_data.csv.

[Figure 1: Example contents of employee_data.csv]

1.2 Start the schema wizard

1. Open Infor OS Portal.
2. On the OS application page, select the Data Fabric card.
3. In the navigation menu, expand Data Catalog and select Object Schemas.
4. Click + Add and select Generate from Sample Data.

[Figure 2: Object Schemas page with the Generate from Sample Data option]

1. Drag and drop employee_data.csv into the upload area, then click Next.

[Figure 3: Sample file upload step]

1.3 Define the object

Data Catalog detects the column structure and data types automatically. Click Next.

[Figure 4: Object information fields completed]

1.4 Adjust property data types

Keep the defaults, except for the following changes (recommended best practice):

Click Next.

[Figure 5: Property Definitions with updated data types]

1.5 Configure additional metadata

Click Next.

[Figure 6: Additional Metadata configuration]

1.6 Review and finish

Review the Schema and Additional Metadata tabs, then click Finish.

[Figure 7: Schema review screen]

Part 2. Upload Data to the Data Lake

2.1 Add the Atlas Upload widget

1. [Figure 8: Workspaces Insights sidebar with Add Insight Group]
2. [Figure 9: Insight Group naming dialog]
3. [Figure 10: Add Widget button in the new Insight Group]
4. [Figure 11: Widget Catalog search results]
5. [Figure 12: Closing the Widget Catalog and saving]

The Atlas Upload widget now appears in your Data Fabric workspace.

2.2 Upload the data file

1. [Figure 13: File upload in the Atlas Upload widget]
2. [Figure 14: Target object selection]
3. [Figure 15: Upload confirmation message]

Part 3. Data Fabric Security Architecture

Data Fabric enforces security at three levels:

Data Access supports three settings:

Part 4. Create Security Roles in Infor OS Portal

Security roles must exist in Infor OS Portal before you can create profiles for them in Data Fabric.

The HR Department Manager role is used in the final challenge.

4.1 Open Security Roles

1. On the OS application page, select the Security card.
2. Go to Configure → Master Data Types → Security Roles.

[Figure 16: Navigation path to Security Roles]

4.2 Create the HR Analyst role

Click + Add new item and enter the following:

Click Save.

[Figure 17: HRANALYST role form]

4.3 Create the HR Department Manager role

Click + Add new item again and enter the following:

Click Save.

[Figure 18: HRDEPTMANAGER role form]

Part 5. Create the HR Analyst Security Profile

5.1 Create the profile

1. Go to Data Fabric → Security.
2. Click + to create a profile.
3. In Select Security role, search for and select HRANALYST_[YOUR_INITIALS].
4. Click Save.

[Figure 19: Create Profile dialog]

5.2 Configure access controls

Select the HRANALYST_[YOUR INITIALS] profile and open the Access Controls tab.

[Figure 20: Data Lake access controls for HRANALYST]

All other components must remain OFF:

[Figure 21: Remaining components switched off]

5.3 Configure data security

1. In the profile, open the Data Security tab.
2. Find EmployeeData_[YOUR_INITIALS] and switch it ON.
3. Expand the Object access card.
4. Enable Selected properties only.
5. Select the properties shown below, then click Save.

[Figure 22: Property-level data security for HRANALYST]

Part 6. Enable Data Security (If Required)

Important: Enabling data security affects all users in the tenant. Consult your system administrator first.

1. Check the current status. If the Enable data security button appears at the top of the Security page, data security is currently disabled.
2. Enable enforcement (only if approved). Click Enable data security, then confirm with Yes.

[Figure 23: Enable data security button and confirmation dialog]

Once enabled, users can access only the data they have been explicitly granted.

3. Challenge: Configure the HRDEPTMANAGER Profile

Department managers need broader access than HR analysts. Budget planning requires salary and hire date information, but birthdate information is not needed.

Business Requirements

The HRDEPTMANAGER role must:

• Access Atlas to browse and download employee data files.
• Access Compass to run analytical queries on employee data.
• Access Data Ledger to validate data integrity for reporting.
• View Metagraphs to understand data relationships (read-only).
• See all employee data except birthdate, including salaries and hire dates.
• Not access Purge (data deletion) or Security (administrative functions).

Tasks

Task 1. Create the profile

1. On the Data Fabric Security page, click +.
2. Select HRDEPTMANAGER_[YOUR_INITIALS] as the security role.
3. Save and close.

Task 2. Configure access controls

Based on the business requirements, decide:

• Which Data Lake pages should be enabled?
• Should Compass access be enabled?
• Should Metagraphs access be enabled?
• Should Pipelines access be enabled?
• Should Security access be enabled?

Task 3. Configure data security

Based on the business requirements, decide:

• Which property access level applies to the EmployeeData object?
• Which properties should be included?
• Should salary and hire date be accessible?
• Should birthdate be accessible?

Task 4. Export the configuration

1. After saving the profile, hover over HRDEPTMANAGER in the Security Profiles list.
2. Click the More icon (three dots).
3. Select Export.
4. Save the JSON file for validation.

Submission

Upload the JSON file containing your HRDEPTMANAGER profile configuration.

Common Issues

• The EmployeeData object is missing or misnamed.
• The Salary property is not accessible.
• The export was made too early, or the JSON is malformed.
• The role or profile name is wrong, or the role was not created in the Portal.
• The accessLevel value or other JSON keys are invalid or missing.
• The property list is missing for property-level access.