Restricted asset classification in Amazon SageMaker Unified Studio
With restricted classification, domain unit owners and glossary project owners can control who can apply specific classification terms to assets in the Amazon SageMaker Catalog. This feature helps maintain classification consistency and governance standards across your domain while enabling controlled workflows based on governed classification terms.
Restricted classification provides the following benefits:
-
Governance control – Maintain consistent classification standards across your entire domain
-
Access management – Control which users can apply sensitive or restricted classification terms to assets
-
Workflow enablement – Build automated workflows based on governed classification terms
-
Clear separation – Distinguish between open and restricted classification terms
SageMaker catalog separates classification terms into two categories:
-
Unrestricted terms – Available for all users to apply to their assets
-
Restricted terms – Only authorized users can apply these to assets they own
This functionality uses the following authorization model:
-
Glossary project owners and contributors can create and manage restricted glossaries. Project owners can grant usage permissions to specific domain units and to other project owners and contributors. If a contributor creates a restricted glossary, only the project owner receives permission to use it by default.
-
By default, project owners can use the glossary for the assets in their projects.
-
Authorized users receive permission to use the restricted terms for their projects when you add project-specific grants.
-
All users can filter and discover assets using restricted classification terms.
When you use restricted glossaries in Amazon SageMaker Unified Studio, you must follow these constraints:
-
Scope of application – Restricted glossary terms are supported only at the asset level. Column-level terms, metadata form-level terms, and data product-level terms are not supported.
-
Term relationships – Restricted glossary terms cannot be related to other terms.
-
Glossary usage permission conversion – After you create a restricted glossary, you cannot convert it into a regular glossary, and you cannot convert a regular glossary into a restricted glossary.
Creating restricted classification terms
As a project owner or contributor, complete the following steps:
-
Navigate to the catalog governance section
-
Define terms within the glossary
-
Set usage policies for the restricted glossary
Applying restricted terms to assets
Complete the following procedure based on the configured usage permission for the restricted glossary:
Apply restricted terms to assets
-
Navigate to Amazon SageMaker Unified Studio using the URL from your admin and log in using your SSO or AWS credentials.
Then choose Manage in the left navigation pane.
Manage in the left navigation pane.
in the left navigation pane.
-
Under Catalog management, choose Assets.
-
Find the asset to which you want to assign restricted terms and open it.
-
Under Glossary terms, choose the edit button, and then choose Add terms. Search for the restricted term that you want to assign to the asset, and then choose it.
Choose Add terms. After the term is added, you can identify it as a restricted term by the lock icon next to its name.
You can associate or disassociate up to 5 restricted terms with/from an asset at any one time.
