withsoon

YouTube data platform — Governance / Quality

01

Quality Flow

Record fails → quarantine with reason; repair and replay only after validation.
Release fails → hold the candidate; consumers keep the last certified version.

Where checks run

02

Quality Dimensions

03

Release Decisions

Certification flow

Hard-block conditions
Missing partitionsIncompatible schemaDuplicate spikeBroken relationshipsReconciliation failureConsent violationUnexplained drift
Warning contract
Measures remain correctNoncritical gapNamed ownerExplicit impactExpiry timeFollow-up tracked
04

Privacy Controls

Privacy-request execution

Replay safety: every backfill checks durable privacy tombstones before rebuilding Silver, Gold, caches, or features. A later Bronze replay must never resurrect a deleted identity.
05

Lineage + Ownership

Trace a number backward

Creator Studio metric
Certified Gold row
Silver watch session
Bronze event + offset
Player contract + owner
Domain ownerContract meaning · metric semantics · product quality · SLO · incident response
Platform ownerKafka · compute · Iceberg · catalog · quality framework · access mechanisms
Privacy / SecurityPolicy · sensitive access · residency · deletion evidence · regulatory review
06

Observability

Every alert must answer

01Severity
02Owner
03Runbook
04Business impact
05Lineage link
06Recent deployments
07

Interview Answer

Governance and quality wrap every YouTube data layer rather than running as a final audit. Producer contracts define schema, semantics, privacy class, and ownership; ingestion rejects malformed records to quarantine; Silver validates deduplication, identity scope, relationships, and distributions; and Gold is published only after completeness, freshness, reconciliation, semantic, and finance checks. A hard failure keeps consumers on the last certified version, while a bounded warning requires an owner, impact statement, expiry, and follow-up. DataHub, Unity Catalog, or Purview provides discovery and lineage from a Creator Studio metric back to source events and owners. Sensitive data is classified and tokenized, consent is enforced before downstream use, made-for-kids data receives stricter treatment, and RBAC/ABAC, row and column security, masking, TLS, and KMS protect access. GDPR and CCPA requests propagate deletion or anonymization through Iceberg, warehouses, caches, and feature stores, with tombstones preventing a future Bronze replay from restoring the identity. Finally, infrastructure, pipeline, data, and business monitoring route every alert with severity, owner, runbook, impact, lineage, and recent deployment context.