KESTREL
DO

Scan report

6 findings, written back.

offlinewrite-back applied
Provenance

generated from fixtures/healthcare.json, not a live DataHub — the shapes are real, the instance is not

Violations

6

Policies

4

Subjects

15

Paths walked

18

Write-backs

22/26

run kestrel-example-run · started 2026-08-06 05:36:58 UTC

highpii-reaches-bipii-reaches-bi-82fa8982

healthcare.raw.patients.ssn reaches Dashboard/Chart 'patient_overview' via a 4-hop path, with no mask/hash/sha2 (+4 more) step on the way.

Subject

patients.ssnstring

urn:li:schemaField:(urn:li:dataset:(urn:li:dataPlatform:postgres,healthcare.raw.patients,PROD),ssn)

Exposed at

patient_overviewdashboard

urn:li:dashboard:(looker,patient_overview)

Owner

dana.okoro

The path · 4 hops

patients.ssnstringstg_patients.ssnstringpatient_encounters.patient_ssnstringencounter_summary.patient_ssnstringpatient_overviewdashboard
  • Hop 1passthroughINSERT INTO healthcare.staging.stg_patients SELECT patient_id, ssn, full_name FROM healthcare.raw.patients
  • Hop 2join on patient_idCREATE TABLE healthcare.marts.patient_encounters AS SELECT e.encounter_id, p.ssn AS patient_ssn, e.provider_id, e.encounter_date FROM encounters e JOIN healthcare.staging.stg_patients p USING (patient_id)
  • Hop 3passthrough into reporting viewCREATE VIEW healthcare.analytics.encounter_summary AS SELECT patient_ssn, COUNT(*) AS encounters, encounter_date FROM healthcare.marts.patient_encounters GROUP BY patient_ssn, encounter_date
  • Hop 4table-levelLooker explore: encounter_summary

note: column lineage unavailable at this hop; followed table-level lineage

Written back to DataHub

  • Tagtagged `patients.ssn` with `policy-violation`applied
  • Tagtagged exposure point `patient_overview` with `policy-violation`applied
  • Recordrecorded `io.kestrel.policy_violation` on `patients.ssn`applied
  • Documentauthored incident document "Policy violation: pii-reaches-bi - healthcare.raw.patients.ssn -> patient_overview"applied
  • Notifydrafted owner ping for dana.okoro -> out/examples-scratch/actions/pii-reaches-bi-82fa8982.notify.mddrafted

Suggested fix

Mask or hash the column at the first transform downstream of the source, or drop it from the downstream model. If the exposure is reviewed and accepted, tag the mitigating step `Masked` so this policy stops reporting the path.

highpii-reaches-bipii-reaches-bi-15dc0b3c

healthcare.raw.claims.member_dob reaches Dashboard/Chart 'claims_by_age' via a 2-hop path, with no mask/hash/sha2 (+4 more) step on the way.

Subject

claims.member_dobdate

urn:li:schemaField:(urn:li:dataset:(urn:li:dataPlatform:postgres,healthcare.raw.claims,PROD),member_dob)

Exposed at

claims_by_agechart

urn:li:chart:(looker,claims_by_age)

Owner

sam.reyes

The path · 2 hops

claims.member_dobdateclaims_enriched.member_dobdateclaims_by_agechart
  • Hop 1passthroughCREATE TABLE healthcare.marts.claims_enriched AS SELECT claim_id, member_dob, amount FROM healthcare.raw.claims
  • Hop 2table-levelLooker explore: claims_enriched

note: column lineage unavailable at this hop; followed table-level lineage

Written back to DataHub

  • Tagtagged `claims.member_dob` with `policy-violation`applied
  • Tagtagged exposure point `claims_by_age` with `policy-violation`applied
  • Recordrecorded `io.kestrel.policy_violation` on `claims.member_dob`applied
  • Documentauthored incident document "Policy violation: pii-reaches-bi - healthcare.raw.claims.member_dob -> claims_by_age"applied
  • Notifydrafted owner ping for sam.reyes -> out/examples-scratch/actions/pii-reaches-bi-15dc0b3c.notify.mddrafted

Suggested fix

Mask or hash the column at the first transform downstream of the source, or drop it from the downstream model. If the exposure is reviewed and accepted, tag the mitigating step `Masked` so this policy stops reporting the path.

highpii-reaches-bipii-reaches-bi-6580a708

healthcare.raw.legacy_billing.member_ssn reaches Dashboard/Chart 'revenue_ops' via a 2-hop path, with no mask/hash/sha2 (+4 more) step on the way.

Subject

legacy_billing.member_ssnstring

urn:li:schemaField:(urn:li:dataset:(urn:li:dataPlatform:postgres,healthcare.raw.legacy_billing,PROD),member_ssn)

Exposed at

revenue_opsdashboard

urn:li:dashboard:(looker,revenue_ops)

Owner

morgan.diallo

The path · 2 hops

legacy_billing.member_ssnstringbilling_rolluptablerevenue_opsdashboard
  • Hop 1table-levelnightly rollup jobINSERT INTO healthcare.marts.billing_rollup SELECT invoice_id, member_ssn, amount_due FROM healthcare.raw.legacy_billing
  • Hop 2table-levelLooker explore: billing_rollup

note: column lineage unavailable at this hop; followed table-level lineage

Written back to DataHub

  • Tagtagged `legacy_billing.member_ssn` with `policy-violation`applied
  • Tagtagged exposure point `revenue_ops` with `policy-violation`applied
  • Recordrecorded `io.kestrel.policy_violation` on `legacy_billing.member_ssn`applied
  • Documentauthored incident document "Policy violation: pii-reaches-bi - healthcare.raw.legacy_billing.member_ssn -> revenue_ops"applied
  • Notifydrafted owner ping for morgan.diallo -> out/examples-scratch/actions/pii-reaches-bi-6580a708.notify.mddrafted

Suggested fix

Mask or hash the column at the first transform downstream of the source, or drop it from the downstream model. If the exposure is reviewed and accepted, tag the mitigating step `Masked` so this policy stops reporting the path.

highstale-upstream-feeds-livestale-upstream-feeds-live-f1771ba2

healthcare.marts.patient_360 is certified but depends on healthcare.raw.lab_results, which is tagged Stale/Deprecated/Quality:Failed, 2 hops upstream.

Subject

patient_360table

urn:li:dataset:(urn:li:dataPlatform:snowflake,healthcare.marts.patient_360,PROD)

Exposed at

lab_resultstable

urn:li:dataset:(urn:li:dataPlatform:postgres,healthcare.raw.lab_results,PROD)

Owner

dana.okoro

The path · 2 hops

patient_360tablestg_labstablelab_resultstable
  • Hop 1table-levellatest result per patient
  • Hop 2table-levelcleanse + dedupe

note: column lineage unavailable at this hop; followed table-level lineage

Written back to DataHub

  • Tagtagged `patient_360` with `policy-violation`applied
  • Tagtagged exposure point `lab_results` with `policy-violation`applied
  • Recordrecorded `io.kestrel.policy_violation` on `patient_360`applied
  • Documentauthored incident document "Policy violation: stale-upstream-feeds-live - healthcare.marts.patient_360 -> lab_results"applied
  • Pull requestdrafted remediation PR -> out/examples-scratch/actions/stale-upstream-feeds-live-f1771ba2.pr.mddrafted

Suggested fix

Refresh or repair the flagged upstream before it feeds a certified asset, or drop the certification until the dependency is healthy. If the upstream is being retired, cut the dependency rather than inheriting its decay.

mediumcertified-dashboard-without-ownercertified-dashboard-without-owner-3f2ac5ca

patient_overview is marked Certified but has no owner. Nobody is accountable for it.

Subject

patient_overviewdashboard

urn:li:dashboard:(looker,patient_overview)

Exposed at

—

Owner

unassigned

nobody is accountable

Written back to DataHub

  • Tagtagged `patient_overview` with `policy-violation`applied
  • Recordrecorded `io.kestrel.policy_violation` on `patient_overview`applied
  • Documentauthored incident document "Policy violation: certified-dashboard-without-owner - patient_overview"applied

Suggested fix

Assign an owner to the dashboard, or drop its certification.

mediumcertified-without-ownercertified-without-owner-47a9eab9

healthcare.marts.patient_encounters is marked Certified / Production but has no owner. Nobody is accountable for it.

Subject

patient_encounterstable

urn:li:dataset:(urn:li:dataPlatform:snowflake,healthcare.marts.patient_encounters,PROD)

Exposed at

—

Owner

unassigned

nobody is accountable

Written back to DataHub

  • Tagtagged `patient_encounters` with `policy-violation`applied
  • Recordrecorded `io.kestrel.policy_violation` on `patient_encounters`applied
  • Documentauthored incident document "Policy violation: certified-without-owner - healthcare.marts.patient_encounters"applied

Suggested fix

Assign a technical and a business owner in DataHub, or remove the certification until someone will stand behind it.