Beyond the data catalogue — governance above the stack.
Catalogues describe. Pipelines move. Warehouses hold. None of them attest. The institutional overlay is the layer the obligation actually lives on.
Cabier Intelligence · 8 June 2026 · ~13 min read
Executive summary
Data-tool consolidation has been the dominant CDO programme of the last decade. Collibra, Alation, Informatica and Microsoft Purview each occupy a defensible position; Snowflake and Databricks have absorbed the warehouse layer beneath them. The catalogue is better than it has ever been. The supervisory finding pattern has not closed.
The reason is altitude. The tools operate at the asset and execution layer; the obligation operates at the institutional layer. The substrate that carries the obligation is the missing piece — not because the tools are wrong, but because they are designed for a different question.
What catalogues are, and are not
A catalogue is an inventory of assets: tables, fields, owners, definitions, sensitivity classifications, policies. It is the institutional memory of what exists. It is not, and was never designed to be, the institutional evidence that an obligation was met on a particular day for a particular regulator-facing number.
Extending the catalogue schema does not change its purpose. You can record more attributes; you cannot change the layer.
What pipelines are, and are not
A pipeline moves data, transforms it, and lands it. It is essential infrastructure. It is not the place where an institution records why a transformation is fit for the regulated use that consumes it. The pipeline knows the SQL ran. The substrate knows whether the SQL was the right answer to the supervisory question.
Why an overlay is the right altitude
The overlay is not a competitor to the catalogue or the pipeline. It is a different shape. It reads from both; it adds an institutional layer that neither can hold on its own. The overlay's primitive is the obligation, not the asset and not the execution.
Three properties matter. The overlay is portable — it does not bind the institution to a specific catalogue or warehouse choice. It is read-mostly — it does not move data and does not duplicate authoritative state. And it is regulator-facing — the primary user is the supervisor, the external auditor, and the institution's own internal-audit function.
Where the overlay plugs in
Above the catalogue, the warehouse, the lakehouse, the pipeline, and the policy substrate. The integrations are read-shaped: asset inventory from the catalogue, lineage from the warehouse and the pipeline, policy and sensitivity from the catalogue and the privacy management tool, controls and exceptions from the GRC substrate. The overlay synthesises the dependency graph above all of them and emits the regulator-facing evidence.
From description to evidence
The shift is from "we have a catalogue entry asserting this lineage" to "we have a traced record that the lineage ran on the date of your question, against the authoritative source you would expect, with the controls graded for the use the number supports". That is the institutional substrate. That is what the overlay exists to carry.
What this is not
We do not publish the dependency-graph internals, the grading rubric or the control library specifics in public material. Those are released only under signed terms.
Frequently asked questions
Is Cabier a data catalogue?
No. We sit above the catalogue layer. Collibra, Alation, Informatica and Purview are inputs to our substrate; they are not replaced by it.
Why not just configure the catalogue more deeply?
Because the catalogue's primitive is the asset description, not the supervisory obligation. You can extend the schema; you cannot change what the tool is for.
Is Cabier a pipeline or ETL tool?
No. We do not move data. We carry the obligation across the pipeline that already moves it.
How does the overlay interact with Microsoft Purview?
Purview provides the asset inventory, sensitivity classification and policy distribution. The overlay consumes those records and adds the regulator-facing lineage, control evidence and attestation layer.
How does it interact with Collibra and Alation?
The same pattern. The catalogue is the source of asset truth; the overlay is the source of obligation truth. The mapping between them is the integration.
What about Snowflake and Databricks?
Warehouse and lakehouse environments are read as systems-of-record-of-record. The overlay traces through the SQL and the model lineage they expose.
Does this work for institutions on legacy mainframes?
Yes. The overlay does not require modern infrastructure. It requires only the ability to read the lineage of the systems already in place.
Why is the catalogue alone not enough for BCBS 239?
Because BCBS 239 asks for a traced and graded substrate, not a described inventory. The catalogue is necessary; it is not sufficient.
Why is the warehouse alone not enough?
Because the warehouse holds the data; the regulator asks about the chain that produced it. The chain crosses systems the warehouse does not see.
Why is the pipeline alone not enough?
Because the pipeline moves the data; it does not record why the movement is fit for the regulated use that consumes it.
What does 'governance above the stack' mean in practice?
It means the obligation lives in one place above the tools, instead of being reassembled from each of them at quarter-end.
Does the overlay duplicate metadata?
No. The overlay reads the metadata the tools already hold and synthesises the dependency graph above them. Duplication is what we are designed to remove.
How is the overlay deployed?
Through a sovereign-region or on-premise deployment, with read access into the existing catalogue, warehouse and policy substrate. There is no mandatory US data storage.
Is this only for banks?
No. Insurers, sovereign ministries, port and transport authorities, and hyperscalers serving regulated customers all carry the same obligation pattern.
How long does an overlay engagement take to first evidence?
Typical engagements produce first regulator-facing evidence inside the first reporting cycle after deployment. Full coverage is multi-quarter.
Does the overlay create vendor lock-in?
No. The overlay is intentionally portable. The substrate is documented in open data models and can be exported on exit.
Is there a public price list?
No. Every engagement is custom-quoted under signed terms.
Who is the buyer?
The Chief Data Officer, the Head of Risk Data, the Head of Privacy & Records, or the General Counsel in regulated industries.
Glossary
- Data catalogue
- Inventory of data assets, definitions, owners and sensitivity classification — a description layer.
- Data pipeline
- The infrastructure that moves and transforms data between systems — an execution layer.
- Data lakehouse
- A warehouse-on-object-storage architecture (e.g. Databricks, Snowflake) combining warehouse semantics with lake economics.
- Metadata
- Data about data — schemas, lineage, ownership, sensitivity, retention.
- Overlay
- An institutional layer sitting above the tools that carries the obligation across them.
- Substrate
- Cabier's term for the single record behind every regulator-facing number.
- Lineage
- The traced path of a data element through every transformation into the report line.
- Dependency graph
- The real-time map of which inputs feed which outputs across systems.
- Attestation
- A formal record that a control was in effect, ran as designed, and produced the expected evidence.
- Control evidence
- The artefacts that demonstrate a control operated — log lines, reconciliation reports, exception queues, sign-offs.
- BCBS 239
- Basel Committee Principles for Effective Risk Data Aggregation and Risk Reporting.
- GDPR
- EU General Data Protection Regulation — privacy and data-rights regime in force since 2018.
- CPRA
- California Privacy Rights Act — successor to the CCPA, in force from 2023.
- PIPEDA
- Canada's federal Personal Information Protection and Electronic Documents Act.
- APPI
- Japan's Act on the Protection of Personal Information; 2026 amendments expand cross-border obligations.
- LGPD
- Brazil's Lei Geral de Proteção de Dados — the federal privacy regime.
- Microsoft Purview
- Microsoft's unified data governance product, focused on asset inventory, classification and policy.
- Collibra
- Independent data-catalogue platform; broad coverage of stewardship and policy distribution.
- Alation
- Independent data-catalogue platform; strong on search and analyst workflow.
- Informatica
- Enterprise integration and data-management platform; deep ETL, MDM and quality coverage.
- Snowflake
- Cloud data-warehouse platform; common system-of-record-of-record in large institutions.
- Databricks
- Lakehouse and machine-learning platform; common analytics substrate above object storage.
- CDO
- Chief Data Officer — accountable executive for the institution's data substrate.
- Three lines of defence
- Risk operating-model convention separating business, oversight and assurance.
- Custom quote
- Cabier's standing pricing policy: no engagement is publicly priced; every scope is sized and quoted under signed terms.
Continue