# Data Mesh Security
Data mesh security refers to the practices, controls, and governance mechanisms required to secure a data mesh architecture. Data mesh is a decentralized data management paradigm where domain teams own and operate their data as products, exposed through self-serve infrastructure. Unlike centralized data lakes or warehouses, data mesh distributes both data ownership and security responsibility across domain boundaries. This creates a fundamentally different security challenge: protecting data that has no single owner, no single location, and no single access pattern.
A data mesh architecture has four core principles, each with distinct security implications:
Domain Ownership: Each business domain (sales, engineering, operations) owns its data products end-to-end. Security consequence: access control, encryption, and classification policies must be defined and enforced at the domain level, not centrally.
Data as a Product: Data is treated as a product with SLAs for quality, availability, and security. Security consequence: each data product must have documented security properties including classification level, encryption standards, retention policies, and access requirements.
Self-Serve Data Infrastructure: A central platform team provides self-serve tooling for provisioning, monitoring, and governance. Security consequence: the platform must enforce security guardrails (encryption at rest, audit logging, access policies) as defaults that domain teams cannot bypass.
Federated Computational Governance: Global policies are set centrally but enforced locally by domain teams. Security consequence: security policies (data classification, retention, access control) must be codified as automated policies, not manual checklists.
Security controls in a data mesh:
Organizations are adopting data mesh because centralized data teams have become bottlenecks. But decentralization without security governance creates chaos. Without proper controls, data mesh architectures can result in inconsistent encryption, unmonitored access, orphaned datasets with no security owner, and regulatory violations when data crosses domain boundaries.
The regulatory landscape makes this worse. GDPR, CCPA, and sector-specific regulations require organizations to demonstrate control over personal data. In a data mesh, that personal data may exist in dozens of domain-owned products. Without federated governance, compliance becomes nearly impossible.
The organizations that succeed with data mesh security treat it as a platform capability, not an afterthought. Security is baked into the self-serve infrastructure so domain teams get secure-by-default data products without needing to be security experts.
CDA addresses data mesh security through the Data Protection & Sovereignty (DPS) domain under the Sovereign Data Protocol (SDP). Our position: decentralization of data is inevitable, but decentralization of security policy is unacceptable. The answer is federated governance with centralized policy and distributed enforcement.
Operational approach:
Under Zero Possession Architecture, CDA designs data mesh security controls without accessing the data products themselves. We configure the governance framework; domain teams manage their data within those guardrails.