Clarifying the difference between data governance roles and user permissions in Contact Management

[devpro751]

I’m trying to understand how data governance roles relate to user permissions in Adobe Experience Cloud’s Contact Management module. We’re on AEC 2021 and I’m seeing what appears to be two separate systems for controlling access.

There are governance roles like Data Steward, Data Owner, and Data Custodian that seem to be about accountability and oversight. Then there are user permissions like View Contacts, Edit Contacts, Export Data that control what actions users can actually perform. How do these two systems work together? Do governance roles automatically grant certain permissions, or are they completely independent? And how do we map governance responsibilities to technical access controls for proper access audits? Looking for clarity on the relationship between these concepts.

Two distinct layers are in play here, and conflating them is a common source of audit headaches.

Governance roles (Data Steward, Data Owner, Data Custodian) are accountability constructs — they define who is responsible for data quality, classification, lifecycle decisions, and policy enforcement. They exist primarily in policy documentation, RACI matrices, and within Adobe’s Data Governance framework (surfaced in Experience Platform under the Labels, Policies, and Consent tooling). They carry organizational meaning, not system-enforced access boundaries by default.

User permissions are technical enforcement constructs — they control what a principal can actually execute within the product. In AEC’s context, these are managed through Adobe Admin Console and, for Experience Platform-adjacent products, through Attribute-Based Access Control (ABAC) (verify availability in your version). Permissions like View Contacts, Edit Contacts, Export Data are granted to users or product profiles directly.

Critical point: governance roles do not automatically provision permissions. The mapping is manual and must be designed deliberately.

Criteria	Governance Roles	User Permissions
Purpose	Accountability & oversight	Technical access enforcement
Defined in	Policy/RACI, Data Governance UI	Admin Console, ABAC policies
Auto-provisioned?	No	Yes, via product profile assignment
Audit surface	Governance policy logs, role assignments	Access control logs, Admin Console
Enforcement mechanism	Organizational process	System-level enforcement
Granularity	Coarse (role archetypes)	Fine-grained (object + action level)

Mapping governance responsibilities to technical controls typically follows this pattern:

1. Define each governance role’s data access needs (read, write, export, delete) in your policy documentation.
2. Create corresponding product profiles in Admin Console that reflect those access needs.
3. Assign users holding a governance role to the matching product profile — this is the manual bridge.
4. Where ABAC is available (verify in your version), use data usage labels to restrict access to sensitive contact fields independent of role assignment.
5. Document the mapping explicitly in your access matrix so auditors can trace governance accountability back to technical permissions.

For audit purposes, you’ll need to pull from two sources: the governance role assignment records (who is designated Data Owner for a given dataset) and the Admin Console permission logs (what that person can technically do). Neither system generates a unified audit trail automatically — that reconciliation is a manual or custom-reporting exercise.

The right balance between tightly coupling governance roles to permission sets versus keeping them loosely coupled depends on context / your requirements — regulated industries typically enforce tight 1:1 mapping, while less constrained environments may grant governance roles broader permissions to reduce operational friction.

---

This draft is based on general Adobe Experience Cloud knowledge. It has not been verified against your specific version and environment. Practitioners: verify the steps and share your experience below.

[victoria_powerbiar]

They’re definitely separate but complementary. User permissions are technical controls - they’re enforced by the system to allow or deny specific actions. Governance roles are organizational responsibilities - they define who’s accountable for data quality, compliance, and stewardship. A user can have extensive permissions but no governance role, or have a governance role like Data Steward but limited technical permissions.

[robert_aws]

In our implementation, we map governance roles to permission sets. Every Data Owner gets a baseline set of permissions that allows them to review and approve changes to their data domain. Data Stewards get permissions to edit and validate data within their assigned areas. Data Custodians get system administration permissions to manage technical aspects. This mapping ensures governance responsibilities can actually be executed through the system.

[carol_martin]

For access audits, we need both views. The governance role tells us who’s responsible for the data - who should be held accountable if something goes wrong. The user permissions tell us what actions they can actually perform - what technical access they have. During audits, we verify that users with governance roles have appropriate permissions to fulfill their responsibilities, and that users with sensitive permissions have corresponding governance accountability assigned.

[deepak_singla]

That makes sense. So if I assign someone as Data Steward for a contact segment, that’s an accountability assignment. Then I separately need to grant them Edit Contacts permission for that segment so they can actually do the stewardship work. Is there a recommended way to automate that permission mapping so we don’t have mismatches?

[appsmithk]

Yes, you should definitely automate the mapping to prevent governance roles without appropriate permissions. In Contact Management, you can configure role-based permission templates that automatically grant required permissions when someone is assigned a governance role. For example, the Data Steward template grants View, Edit, and Validate permissions for assigned contact segments, plus access to data quality reports. The Data Owner template grants approve-level permissions plus the ability to assign other stewards. This ensures governance roles come with the technical access needed to fulfill the responsibilities.

[jackg]

Let me provide a comprehensive explanation of how data governance roles and user permissions work together in Adobe Experience Cloud’s Contact Management, including best practices for role-based access and permission mapping.

Understanding the Two-Layer Model

Adobe Experience Cloud uses a two-layer access control model. The bottom layer is technical permissions - granular system controls that allow or deny specific actions like viewing contact records, editing phone numbers, exporting data, or running reports. These are enforced by the application and cannot be bypassed. The top layer is governance roles - organizational assignments that define accountability, responsibility, and oversight for data domains. These are primarily about who’s responsible for data quality, compliance, and decision-making.

The key insight is that governance roles define what someone should be able to do based on their organizational responsibility, while permissions define what they can actually do in the system. Proper access control requires both layers to be aligned.

Role-Based Access Design

In Contact Management, role-based access should start with defining governance roles based on your organization’s data management structure. Common governance roles include Data Owner (executive accountable for a data domain like customer contacts), Data Steward (operational manager responsible for data quality and compliance in assigned segments), Data Custodian (technical administrator managing system infrastructure), and Data User (consumer of data for business purposes).

Each governance role should have a defined scope (which contact segments they’re responsible for), responsibilities (what they’re expected to do with the data), and accountability (what outcomes they’re measured on). For example, a Data Steward for North American enterprise contacts is responsible for ensuring those contact records are complete, accurate, and compliant with regional regulations.

Permission Mapping Strategy

Once governance roles are defined, map them to permission sets that enable the required responsibilities. A Data Owner needs permissions to view all records in their domain, approve significant changes, assign stewards, and access governance reports. They typically don’t need edit permissions for day-to-day data entry - that’s operational work, not governance oversight.

A Data Steward needs view and edit permissions for their assigned segment, access to data quality validation tools, ability to run cleansing workflows, and permissions to review audit logs for their segment. They need operational access to maintain data quality but shouldn’t have permissions outside their assigned scope.

A Data User needs view-only permissions for contacts relevant to their job function (sales reps see their territory contacts, marketers see contacts matching campaign criteria). They don’t need governance roles because they’re consuming data, not stewarding it.

Access Audits and Compliance

For access audits, you need to verify three things. First, that every governance role assignment has corresponding permissions to fulfill the responsibilities. A Data Steward without edit permissions can’t actually perform stewardship. Second, that every user with sensitive permissions has appropriate governance accountability. Someone with export permissions for all contacts should have a formal governance role explaining why that access is needed. Third, that permission assignments match current organizational structure and job responsibilities. People who change roles should have their permissions updated accordingly.

In AEC 2021, implement quarterly access certification where governance role owners review all permission assignments in their domain. The system should generate reports showing: governance roles without required permissions (responsibility gaps), permissions without governance roles (accountability gaps), and users with permissions outside their governance scope (potential over-provisioning).

Automated Permission Mapping

To automate the mapping between governance roles and permissions, create permission templates in Contact Management’s security configuration. When you assign someone as Data Steward for a contact segment, the system automatically grants the Data Steward permission template scoped to that segment. The template includes all permissions needed for stewardship work: view contacts, edit contacts, validate data, run quality reports, access audit logs.

You can also configure approval workflows for permission grants. When a manager assigns someone as Data Owner, the system can require approval from the previous Data Owner or a compliance officer before granting the elevated permissions. This adds accountability to governance role assignments.

Separation of Duties

For sensitive operations, implement separation of duties through the governance and permission layers. For example, the ability to export large contact datasets might require both a governance role (Data Owner or designated Data User) and a specific export permission that’s separately granted. This ensures that highly sensitive actions require both organizational accountability and explicit technical authorization.

Practical Implementation in AEC 2021

Start by documenting your governance role definitions and required permissions for each role. Then configure permission templates in Contact Management that bundle the appropriate permissions. Set up automated assignment rules so that when someone receives a governance role, they automatically get the corresponding permission template. Finally, implement monitoring that alerts when governance roles and permissions fall out of alignment - this catches situations where someone loses a governance role but retains the permissions, or gains permissions without proper governance accountability.

The goal is a system where governance roles drive permission assignments, ensuring that access control serves both operational needs and compliance requirements. This alignment makes access audits straightforward because you can verify that permissions match governance responsibilities, and any exceptions are documented and justified.