“Good data governance isn’t a police checkpoint. It’s the bouncer at the club. They’re not there to stop you from getting in. They’re there to keep the wrong stuff out.”​
— John Wernfeldt, Managing Director Northridge Analytics & Data Governance Expert

Why This Matters for Every Data Team

If you’re leading or building a data team, you’ve likely faced the same painful truth: many data governance initiatives seemingly slow down everything.

They’re full of hoops, blockers, and wasted time - designed to protect the data but often strangling its use.

But it doesn’t have to be that way.

In this newsletter, I'll share my pragmatic, low-friction approach to data governance, designed specifically for lean, fast-moving organizations with up to 1,000 employees. It’s built to enable trust, not enforce bureaucracy, and to unlock value by eliminating the biggest time-waster of all: unnecessary access requests.

This is the model I’ve implemented at dozens of VC- and PE-backed companies, and it works like a charm.

While I've also implemented it in much larger orgs, it works best when you start it from the ground up.

The Pain of Traditional Data Governance

Let’s be honest - most people hear “data governance” and think of:

• Endless approval chains
• Weeks (or months) to get access to data
• Unclear ownership and accountability
• Overlapping permissions that nobody fully understands

I once joined a large company as a consultant, and despite being brought in to re-build their data infrastructure, I couldn’t touch any data for weeks.

I was blocked by access requests, legal & GDPR delays, and unclear processes. And as an expensive external consultant, this delay was bleeding money.

That experience triggered a simple but powerful question:

What if you could eliminate the need for data access requests altogether?

Enter: Pragmatic Data Governance

At its core, data governance is about trust. It’s not about gatekeeping; it’s about deciding who can do what with which data and making sure it's done right.

My solution? A role-based, automated governance setup that:

• Matches your org structure
• Eliminates manual access handling
• Enables secure, scalable data usage
• Frees up your data team to work on value-creating tasks

I call it pragmatic data governance. And here’s exactly how it works for me across dozens of companies.

The Stack and Setup

My preferred tech stack:

• BigQuery for data warehousing
• Google Sheets for accessible, quick stakeholder analyses
• Looker Studio or Looker Premium for visualization
• Google Groups for access management
• Google Cloud IAM for permission handling
• Terraform for infrastructure as code (IaC)

The result is a fully governed environment where access is managed once and enforced everywhere.

No recurring tickets. No endless Slack messages. No babysitting permissions.

How It Works: Step-by-Step

1 Define Clear Roles in a Matrix

The access model is a matrix of:

• → Business Domain (e.g. Marketing, Finance)
• → Role Level (User, Super User, Analyst, Engineer)

Typical combinations:

• Marketing User
• Finance Super User
• Data Team Analyst

2 Set Up Google Groups for Each Role

• Every role becomes a Google Group
• Membership in the group determines access

3 Use Google Cloud IAM and Terraform to Assign Permissions

• Every dataset, table, dashboard, Google Sheet and Google Drive Folder is assigned to the right group(s)
• Terraform automates the entire setup, so roles and access are consistent and easy to deploy

4 Automate Metadata & KPI Definitions

• Column descriptions and KPIs are maintained in code
• A Google Sheet reads this metadata and serves as a living data dictionary
• When a job updates a dataset, it also updates the metadata and definitions

5 Role-Based Access = One-Click Onboarding

• New hire joins? Assign their Google Group.
• They instantly get access to all the data assets relevant to their role, across all tools.

What This Solves

✅ No more access requests

• 80% of access needs are covered automatically
• No more Slack threads asking, “Can I get access to this dataset?”

✅ Minimal overhead for data teams

• You stop playing access cop
• Focus shifts back to creating value

✅ Auditability and trust

• Everything is documented and consistent
• Easy to trace who has access to what, and why

✅ Scalable to orgs up to 1,000 people (and more, with care)

• Works especially well for fast-moving startups and scaleups
• Has also been implemented in large enterprises (though it’s harder)

Common Pitfalls (And How to Avoid Them)

While the system works beautifully when set up right, there are a few traps to avoid:

→ Poorly designed roles

• If your roles are too vague or too granular, the system breaks down.
• Spend time upfront defining clear roles based on business function and data needs.
• This gets harder the longer you wait and the larger the company

→ Overlapping permissions

• Avoid role bloat. Make sure every role has a clear boundary.
• Use tools like Terraform to enforce this cleanly.

→ Forgotten edge cases (e.g., temp access for exploration)

• You’ll still need a fallback manual process for special cases (such as temporary access not covered by standard roles)
• But in most orgs, this affects less than 20% of total access needs

→ Unmaintained metadata

• Your data dictionary is a living system
• Automate its update process or it will go stale fast

Bonus: It Prepares You for the AI Layer

Clean, documented, well-governed data isn’t just good hygiene - it’s a precondition for AI-powered conversational analytics.

AI agents need:

• Consistent definitions
• Clear metadata
• Access control

If you want your org to use AI tools like conversational BI or data copilots, you need governance like this in place first.

The Bottom Line

Data governance doesn’t need to be a bottleneck. With the right setup:

• You get security and speed
• Your team can self-serve confidently
• You stop wasting time on repetitive tasks
• And you prepare your org for more advanced analytics down the line

Pragmatic data governance means spending a few days designing a role model that works - and saving your data team hundreds of hours down the road.

If you’re building a data function in a startup or scaleup, don’t wait to get this right. It’s one of the highest ROI investments you can make.

Now go fire your data access ticketing system.

If you want to go deeper into this: I'm sharing more details about this (detailed folder structure, which roles exactly do I use and what they can do etc.) in my Flagship Masterclass "From Dashboard Factory to Strategic Partner" where I reveal all the frameworks that I used to win stakeholder trust, earn a seat at the table, and lead with impact in 40+ companies across all continents (except Antarctica ☃️).

See you next week!

Sebastian