YouTube data platform — Governance / Quality
01
Quality Flow
Record fails → quarantine with reason; repair and replay only after validation.
Release fails → hold the candidate; consumers keep the last certified version.
Where checks run
02
Quality Dimensions
03
Release Decisions
Certification flow
Hard-block conditions
Missing partitionsIncompatible schemaDuplicate spikeBroken relationshipsReconciliation failureConsent violationUnexplained drift
Warning contract
Measures remain correctNoncritical gapNamed ownerExplicit impactExpiry timeFollow-up tracked
04
Privacy Controls
Privacy-request execution
Replay safety: every backfill checks durable privacy tombstones before rebuilding Silver, Gold, caches, or features. A later Bronze replay must never resurrect a deleted identity.
05
Lineage + Ownership
Trace a number backward
Creator Studio metric←
Certified Gold row←
Silver watch session←
Bronze event + offset←
Player contract + owner
Domain ownerContract meaning · metric semantics · product quality · SLO · incident response
Platform ownerKafka · compute · Iceberg · catalog · quality framework · access mechanisms
Privacy / SecurityPolicy · sensitive access · residency · deletion evidence · regulatory review
06
Observability
Every alert must answer
01Severity
02Owner
03Runbook
04Business impact
05Lineage link
06Recent deployments
07
Interview Answer
Governance and quality wrap every YouTube data layer rather than running as a final audit. Producer contracts define schema, semantics, privacy class, and ownership; ingestion rejects malformed records to quarantine; Silver validates deduplication, identity scope, relationships, and distributions; and Gold is published only after completeness, freshness, reconciliation, semantic, and finance checks. A hard failure keeps consumers on the last certified version, while a bounded warning requires an owner, impact statement, expiry, and follow-up. DataHub, Unity Catalog, or Purview provides discovery and lineage from a Creator Studio metric back to source events and owners. Sensitive data is classified and tokenized, consent is enforced before downstream use, made-for-kids data receives stricter treatment, and RBAC/ABAC, row and column security, masking, TLS, and KMS protect access. GDPR and CCPA requests propagate deletion or anonymization through Iceberg, warehouses, caches, and feature stores, with tombstones preventing a future Bronze replay from restoring the identity. Finally, infrastructure, pipeline, data, and business monitoring route every alert with severity, owner, runbook, impact, lineage, and recent deployment context.