Introduction

The Denodo Data Product Lifecycle defines six key roles, each aligned with a specific persona and its responsibilities. This article describes the purpose of each stage and role and provides instructions to create them within a Denodo environment.

Lifecycle Stages

1. Use Case Discovery

This stage identifies business needs and opportunities where data can drive value. The objective is to define the problem to be solved, the business questions to answer, and the expected outcomes.

Personas Involved:

• Business User
• Data Product Owner

2. Design

In the design stage, technical specifications are created based on the use case. This includes defining the logical data model, data sources, data pipelines, transformations, and data privacy and access rules.

Personas Involved:

• Business User
• Data Product Owner
• Data Product Developer
• Data Governance Manager

3. Implementation

The data product is built using the Denodo Platform. Developers create views, joins, data transformations, and enforce security and governance policies.

Personas Involved:

• Data Product Owner
• Data Product Developer
• Data Governance Manager

4. Deployment

The data product is deployed and made available through the platform for consumption. This includes setting up production environments, performance optimization, and publishing the product for broader use.

Personas Involved:

• Platform Owner

5. Consume

End users access and utilize the data product for their day-to-day analysis, reporting, or application needs. Consumption is tracked for insights on adoption and value.

Personas Involved:

• Data Consumer

6. Monitor

This ongoing stage ensures that the data product remains reliable, secure, and valuable. Activities include performance monitoring, issue tracking, policy audits, and collecting user feedback for improvement.

Personas Involved:

• Data Product Owner
• Data Governance Manager

Personas as Denodo Roles

Business Stakeholders

Focused on defining needs, validating outcomes, and ensuring business value. These personas are most involved in the Use Case Discovery, Design, and Consume stages.

Business User

Description

Identifies business needs and validates whether the data product meets their goals. Provides requirements and feedback during the discovery and design stages. Helps define acceptance criteria and communicates with stakeholders. Often, a business user assumes the role of Product Owner.

VDP  

• System Roles

• data_catalog_assisted_query - Data Catalog allows users to retrieve data from views using natural language through assisted queries. This feature is available only for users with the data_catalog_assisted_query role.
• data_catalog_content_admin - The data_catalog_content_admin role grants the following list of privileges by default: Personalize and Content.
• data_catalog_data_preparation - Data Catalog offers several methods to retrieve data from views. One of them is data preparation. This feature is only available for those users with the data_catalog_data_preparation role.
• data_catalog_exporter - To configure how users can export the results of a query Data Catalog provides the Export dialog. Among the available options, you can restrict the set of authorized users to Data Catalog exporters.
• use_large_language_model - grants the privilege of using the features of the Denodo Assistant that invoke a large language model.

• Privileges

• Connect on admin virtual database.
• Connect, Metadata, and Select privileges on the required virtual databases.

Solution Manager

• Privileges

• Connect, Metadata, and Execute on the relevant environments.

Data Catalog

• Collaboration

• Endorsements: Create, Edit, Delete.
• Warnings: Create, Edit, Delete.
• Deprecations: Create, Edit, Delete.

• User

• VQL Shell

• Request

• Access: Create, Manage.
• Change:  Create, Manage.
• Data quality:  Create, Manage.
• Question:  Create, Manage.
• Configure req: Yes.

• External element

• Visualize and visualize external data.

Scheduler

• System Privileges

• Not needed.

Data Product Owner

Description

Sets the vision and roadmap for the data product, ensuring it aligns with business objectives and addresses key challenges. Fosters stakeholder collaboration, ensures the data product is accurate, compliant, secure, and accessible to authorized users. Makes critical decisions regarding scope, priorities, and changes, balancing business needs with technical feasibility.

Drives the end-to-end lifecycle of the data product. Acts as a liaison between business and technical teams, ensures alignment with goals, and oversees delivery and monitoring.

VDP

• System Roles

• assign_all_privileges - grants the privilege of assigning all privileges over all metadata elements to all the users and roles except to herself.
• assign_all_roles - grants the privilege of assigning roles to all users/roles. It cannot assign roles to users with assign_all_roles role.
• assignprivileges - grants the privilege of granting/revoking privileges to other users.
• configure_database - grants the privilege of managing configuration for databases.
• create_database - grants the privilege of creating/modifying databases.
• create_role - grants the privilege of creating new roles.
• create_user - grants the privilege of creating new users.
• data_catalog_assisted_query - Data Catalog allows users to retrieve data from views using natural language through assisted queries. This feature is available only for users with the data_catalog_assisted_query role.
• data_catalog_content_admin - The data_catalog_content_admin role grants the following list of privileges by default: Personalize and Content.
• data_catalog_data_preparation - Data Catalog offers several methods to retrieve data from views. One of them is data preparation. This feature is only available for those users with the data_catalog_data_preparation role.
• data_catalog_exporter - To configure how users can export the results of a query Data Catalog provides the Export dialog. Among the available options, you can restrict the set of authorized users to Data Catalog exporters.
• drop_database - grants the privilege of dropping databases.
• drop_role - grants the privilege of dropping a role.
• drop_user - grants the privilege of dropping a user.
• monitor_admin -  grants the privilege of connecting to the monitoring interface of Virtual DataPort. This interface uses the JMX protocol (Java Management Extensions).  You need this privilege to monitor Virtual DataPort with the Diagnostic & Monitoring Tool, the Denodo Monitor, Oracle VisualVM, Oracle Java Mission Control, Nagios, etc.
• manage_policies - grants the privilege of creating, editing, dropping, enabling and disabling Global Security Policies.
• use_large_language_model - grants the privilege of using the features of the Denodo Assistant that invoke a large language model.

• Privileges

• Connect on admin virtual database.
• Create, Metadata, and Execute on the appropriate Interface Views.

Solution Manager

• System Roles

• monitor_admin.

• Privileges

• Connect, Metadata, Write, Monitor, and Execute on relevant environments.

Data Catalog

• Management

• Categories - Create/Delete, Edit, Assign.
• Tags -  Create/Delete, Edit, Assign.
• Property Groups -  Create/Delete, Edit, Assign.
• Elements -  Edit.

• Administration

• Synchronize, Import / Export, Personalize, Content, Permissions.

• Collaboration

• Endorsements - Create, Edit, Delete.
• Warnings - Create, Edit, Delete.
• Deprecations - Create, Edit, Delete.

• User

• VQL Shell

• Request

• Access - Create, Manage.
• Change -  Create, Manage.
• Data quality -  Create, Manage.
• Question -  Create, Manage.
• Configure req - Yes.

• External element  

• Visualize and Visualize External Data

Scheduler

• System Privileges

• Execute, Read and Job.

Technical Implementers

Responsible for designing and building the technical aspects of the data product. Active during the Design, Implementation, and Deployment stages.

Data Product Developer

Description

Responsible for the technical implementation of the data product using Denodo. Builds views, integrations, and enforces access and transformation logic.

VDP

• System Roles

• assign_tags - grants the privilege of assigning tags to views. The user needs to have the METADATA privilege on the affected views.
• create_database - grants the privilege of creating/modifying databases.
• data_catalog_assisted_query - Data Catalog allows users to retrieve data from views using natural language through assisted queries. This feature is available only for users with the data_catalog_assisted_query role.
• data_catalog_content_admin - The data_catalog_content_admin role grants the following list of privileges by default: Personalize and Content.
• data_catalog_data_preparation - Data Catalog offers several methods to retrieve data from views. One of them is data preparation. This feature is only available for those users with the data_catalog_data_preparation role.
• data_catalog_exporter - To configure how users can export the results of a query Data Catalog provides the Export dialog. Among the available options, you can restrict the set of authorized users to Data Catalog exporters.
• manage_policies - grants the privilege of creating, editing, dropping, enabling and disabling Global Security Policies.
• manage_summaries - grants the privilege of managing summaries.
• manage_tags - grants the privilege of creating, editing and dropping tags on Virtual DataPort.
• manage_workspaces - grants the privilege of creating, editing and dropping workspaces on Virtual DataPort.
• metadata_export - allows users with METADATA privilege on elements to get the VQL of those elements without the environment specific properties
• read_all_privileges - grants the privilege of viewing the privileges granted to all the users and roles.
• use_large_language_model - grants the privilege of using the features of the Denodo Assistant that invoke a large language model.

• Privileges

• Connect on admin virtual database.
• Admin on relevant virtual databases.

Solution Manager

• System Roles

•  global_admin.

Data Catalog

• Administration

• Synchronize, Import / Export, Personalize, Content, Permissions.

• Collaboration

• Endorsements - Create, Edit, Delete.
• Warnings - Create, Edit, Delete.
• Deprecations - Create, Edit, Delete.

• User

• VQL Shell.

• Request

• Access - Create, Manage.
• Change -  Create, Manage.
• Data quality -  Create, Manage.
• Question -  Create, Manage.
• Configure req - Yes.

• External element  

• Visualize and Visualize External Data.

Scheduler

• System Privileges

• Create. Write, Execute, Read any job.

Platform Owner

Description

Manages the Denodo environment and is responsible for the successful deployment and operational readiness of data products.

VDP

• System Roles

• assign_all_privileges - grants the privilege of assigning all privileges over all metadata elements to all the users and roles except to herself.
• assign_all_roles - grants the privilege of assigning roles to all users/roles. It cannot assign roles to users with assign_all_roles role.
• assignprivileges - grants the privilege of granting/revoking privileges to other users.
• configure_database - grants the privilege of managing configuration for databases.
• create_database - grants the privilege of creating/modifying databases.
• create_role - grants the privilege of creating new roles.
• create_user - grants the privilege of creating new users.
• data_catalog_assisted_query - Data Catalog allows users to retrieve data from views using natural language through assisted queries. This feature is available only for users with the data_catalog_assisted_query role.
• data_catalog_content_admin - The data_catalog_content_admin role grants the following list of privileges by default: Personalize and Content.
• data_catalog_data_preparation - Data Catalog offers several methods to retrieve data from views. One of them is data preparation. This feature is only available for those users with the data_catalog_data_preparation role.
• data_catalog_exporter - To configure how users can export the results of a query Data Catalog provides the Export dialog. Among the available options, you can restrict the set of authorized users to Data Catalog exporters.
• drop_database - grants the privilege of dropping databases.
• drop_role - grants the privilege of dropping a role.
• drop_user - grants the privilege of dropping a user.
• monitor_admin -  grants the privilege of connecting to the monitoring interface of Virtual DataPort. This interface uses the JMX protocol (Java Management Extensions).  You need this privilege to monitor Virtual DataPort with the Diagnostic & Monitoring Tool, the Denodo Monitor, Oracle VisualVM, Oracle Java Mission Control, Nagios, etc.
• manage_policies - grants the privilege of creating, editing, dropping, enabling and disabling Global Security Policies.
• use_large_language_model - grants the privilege of using the features of the Denodo Assistant that invoke a large language model.

• Privileges

• Connect on admin (or relevant) virtual database.
• Create, Metadata, Execute, and Write on any relevant virtual database.

Solution Manager

• System Roles

•  global_admin - full  admin access to all solution manager functionality.

Data Catalog

• System Roles

• data_catalog_admin - full admin access to all data catalog functionality.

Scheduler

• System Roles

• scheduler_admin - full admin access to all scheduler functionality.

Governance & Oversight

Ensure data quality, compliance, and long-term maintainability. Involved throughout the lifecycle but especially in Design, Implementation, and Monitor stages.

Data Governance Manager

Description

Ensures compliance with data policies, privacy, and quality standards. Defines governance rules and monitors adherence throughout the lifecycle.

VDP

• System Roles

• assignprivileges - grants the privilege of granting/revoking privileges to other users.
• assign_all_privileges - grants the privilege of assigning all privileges over all metadata elements to all the users and roles except to herself.
• assign_all_roles - grants the privilege of assigning roles to all users/roles. It cannot assign roles to users with
• assign_tags - grants the privilege of assigning tags to views. The user needs to have the METADATA privilege on the affected views.
• assign_vdb_admin_privileges - grants the privilege to assign all privileges on a database where the user is admin and its elements, excluding the ‘admin’ privilege, to all users and roles.
• create_role - grants the privilege of creating a new role.
• create_user - grants the privilege of creating a new user.
• data_catalog_classifier

• Assign categories.
• Assign tags.
• Assign property groups.

• data_catalog_editor

• Edit and Assign categories.
• Edit and Assign tags.
• Edit and Assign property groups.
• Edit elements.
• Edit endorsements.
• Edit warmings.

• data_catalog_manager

• Create, Edit, Assign, Delete categories.
• Create, Edit, Assign, Delete tags.
• Create, Edit, Assign, Delete property groups.
• Edit elements.
• Create, Edit, Delete endorsements.
• Create, Edit, Delete warnings.
• Create, Edit, Delete deprecations.

• drop_role - grants privilege to drop a role.
• drop_user - grants privilege to drop a user.
• import_tags - grants the privilege of import tags.
• manage_policies -  grants the privilege of creating, editing, dropping, enabling and disabling Global Security Policies.
• manage_tags - grants the privilege of creating, editing and dropping tags on Virtual DataPort.
• read_all_privileges - grants the privilege of viewing the privileges granted to all the users and roles.

• Privileges

• Connect on admin virtual database.
• Connect, Metadata, Execute and Write on relevant virtual databases.

Data Catalog

• Privileges

• All Data Catalog permissions are assigned implicitly from the VDP roles data_catalog_classifier, data_catalog_editor and data_catalog_manager.

Scheduler

• System Roles

• None required.

End Users

Consume the final product for analysis, decision-making, or integration into applications. Primary participant in the Consume stage and source of feedback for Monitor.

Data Consumer

Description

Uses the data product for reporting, analytics, or decision-making. Their usage and feedback help drive improvements in the product.

VDP

• System Roles

• data_catalog_assisted_query - Data Catalog allows users to retrieve data from views using natural language through assisted queries. This feature is available only for users with the data_catalog_assisted_query role.
• data_catalog_data_preparation - Data Catalog offers several methods to retrieve data from views. One of them is data preparation. This feature is only available for those users with the data_catalog_data_preparation role.
• use_large_language_model - grants the privilege of using the features of the Denodo Assistant that invoke a large language model.

• Privileges

• Connect on admin virtual database.
• Connect, Metadata, Execute and Write on relevant virtual databases.

Data Catalog

• Privileges

• All Data Catalog permissions are assigned implicitly from the VDP roles data_catalog_assisted_query, data_catalog_data_preparation.

Scheduler

• System Roles

• None required.

Appendix

Creation Scripts

Virtual DataPort: Import this VQL file into the VDP server using “denodo” as the import password. It will create the following roles and tags:

• Roles:

• business_user
• data_consumer
• data_governance_manager
• data_product_developer
• data_product_owner
• platform_owner

• Tags:

• confidential
• customer_data
• email_address
• employee_data
• external_sharing
• finance_reporting
• healthcare_dataset
• hipaa_protected
• marketing_analytics
• mask_if_not_admin
• pii
• prod_env
• salary
• sensitive
• ssn

Solution Manager: Import this file into the Solution Manager, it will include the following roles:

• data_product_developer

•   monitor_admin
•   solution_manager_promotion
•   solution_manager_promotion_development
•   solution_manager_promotion_staging

• data_product_owner

• monitor_admin
• solution_manager_promotion
• solution_manager_promotion_production
• solution_manager_promotion_staging

• platform_owner

• global_admin

Data Catalog: Import this file into the Data Catalog to create the following roles:

• data_governance_manager
• business_user
• data_product_owner
• data_product_developer

Scheduler: Import this file into the Denodo Scheduler to configure the roles:

• data_product_developer
• data_product_owner
• platform_owner