Datastrato Enterprise 1.3

The governed catalog you run in production today.

Every permission, tag, policy, and audit trail your lakehouse needs, enforced once across every engine and agent. Supported, with the open core unchanged.

Request a Trial

Datastrato Enterprise console, Explore view: catalogs, schemas, and tables in one tree

The reference architecture

One layer over every catalog. Every request authorized before it runs.

Consumers

Data engines

Spark · Trino · Flink

BI tools

Tableau · Power BI

AI agents

LLM agents · copilots

Applications

data products

Datastrato

API surface

Unified REST · Iceberg REST Catalog (IRC)

Semantic layer coming in 2.0

Metrics, glossary, and domain meaning, shared by every engine and agent. Compliant with Apache Ossie (formerly OSI).

Apache Gravitino

federated metadata and governance layer

Federated catalog

One namespace over Hive, Glue, Iceberg, and the rest

Access control

Roles, row and column policies, vended credentials

Tags and policies

Classification that follows the data into every engine

Audit and lineage

Every request logged, every change traced

Sources · registered in place, no copies

Iceberg

via IRC

Hive and Glue

metastores

Delta · Hudi · Lance

lakehouse formats

Relational

Postgres · MySQL · Oracle

Files and models

S3 · GCS · ADLS

Kafka

topics

Open by default. Iceberg REST and Gravitino REST, no lock-in.

Solutions

Four projects teams start with. One catalog underneath all of them.

Get off Hadoop without a cutover weekend

Hive and Iceberg live under one namespace, so tables move at your pace and every job keeps running against the same catalog.

No mass rewrite. Spark, Hive, and Trino jobs point at one federated catalog; the backend behind a table can change without the job changing.
Table by table, not all or nothing. Migrate the hot tables first, retire Hadoop capacity as you go.
One permission model the whole way. RBAC and audit span Hive and Iceberg, so BCBS 239 and GDPR trails never split in two.

For Hadoop migrations · 1.3

Clients and compute

Spark

Trino

Flink · dbt

BI · SQL

native connectors, or any engine via Iceberg REST

Datastrato

Apache Gravitino federation layer

one namespace · federation router · centralized RBAC · audit and lineage

Routes each request to the right backend

Hive Metastore

existing Hive tables · Thrift

Iceberg REST Catalog

migrated tables · REST

HDFS

retiring

Object storage

S3 · GCS · ADLS

Hive and Iceberg, one namespaceOne audit trailRollback by pointer

One Iceberg REST Catalog across every cloud

A single endpoint for every Iceberg-compatible engine, over tables that stay where they are: on-prem, AWS, Azure, Google Cloud.

One endpoint, zero per-cloud catalogs. No N-by-M sprawl of catalogs and connectors to build, secure, and keep in sync.
Query where the data lives. No copies, no egress, no residency surprises.
Credentials vended per request. Short-lived, scoped to the caller's privileges on AWS, GCP, and Azure.

For hybrid and multi-cloud estates · 1.3

Query and compute engines

Spark

Trino

Flink

Python

one REST endpoint

Datastrato

Single Iceberg REST Catalog endpoint

per-table backend dispatch · credential vending · unified governance

Storage · on-prem and multi-cloud

On-prem

HDFS · MinIO

AWS S3

Azure ADLS

Google Cloud Storage

No data movementResidency-compliantOne governance model

One governed namespace for a regulated estate

Oracle, Teradata, filesets, and cloud catalogs behind one access model and one lineage trail, feeding Trino, Spark, dbt, and AI agents under bank-grade governance.

One source of truth across the estate. Relational, lakehouse, and unstructured systems registered in place; no copies made just to be used.
Audit-ready. Who touched what, for BCBS 239, GDPR, SOX, and data residency, from one lineage and access trail.
Agents on the same path. AI reaches banking data through MCP with the same RBAC as every engine.

For banks and regulated industries · 1.3

Compute and consumption

Federated query

Trino

Data engineering

Spark

Transformation

dbt

Agents

via MCP

Datastrato

Metadata control plane

one governed namespace · federation · tags and classification · policy and RBAC · lineage and audit

Source systems · registered in place

Oracle

JDBC catalog

Teradata

JDBC catalog

NetApp filesets

fileset catalog

Cloud + on-prem IRC

Iceberg catalogs

BCBS 239 lineageGDPR data rightsSOX audit trailsData residency

Governed agentic analytics

An agent assumes the user’s permissions, resolves "revenue" the same way everywhere, and runs through one governed path on any engine.

One governed path. The agent carries the user's identity. RBAC, masking, and credential vending are enforced centrally for tables, files, and embeddings.
Any engine, any agent. Trino, Spark, DuckDB, or yours, through the same MCP server.
Consistent definitions, in 2.0. Every agent resolves a metric from the same Ossie semantic model, so two questions get one answer.

For AI platform teams · MCP in 1.3 · semantics in 2.0

Business user

asks a natural-language question

AI agent

assumes the user's permissions · orchestrates tools via MCP

Datastrato

Gravitino MCP server

catalog and metadata tools · enforces RBAC, masking, credential vending as the user

Semantic layer · resolve_business_term · compile_metric

coming in 2.0

governed query plan

Trino MCP

Spark MCP

DuckDB MCP

Ray MCP

Trusted answer

same metric, every agent, every time · cites model version and owner

Agent acts as the userOne governed pathSame answer, every agent

01 / 04

In the product

Catalogs, policies, and the audit trail, in one console.

Datastrato Enterprise console, Explore view: a schema’s tables, tagged PII and under a 90-day retention policy

Every source, one tree. Hive, Iceberg, JDBC, filesets, and models browsed as one namespace.

Datastrato Enterprise console, Govern view: the Policies tab with one enabled retention policy, attached to four tables

Policy set once. Roles, tags, and row and column rules that follow the data into every engine.

Datastrato Enterprise console, Govern overview: asset counts and policy coverage by catalog and type

Who touched what. Every request logged as the person behind it, agents included.

What you get in 1.3

All the governance. Enterprise identity, audit, and support around it.

Agents carry their own identity

Every agent request through the MCP server is logged and authorized as the person behind it.

Models and files under the same policy

ML models are registered with versions and aliases. Filesets and GVFS put training files and RAG sources under catalog policy.

Lance next to tables

Lance datasets live in the same namespace as the tables they came from.

Enterprise identity

SCIM provisioning from Entra ID and Okta. OIDC sign-in. Groups arrive from the directory you already run.

Operations

Supported Helm chart pinned per release. Health and readiness endpoints. Deploys on EKS, AKS, GKE, OpenShift, or any Kubernetes 1.29+.

Audit export and support

Audit events exported as JSON to Splunk and Datadog. Standard and premium support with a defined response commitment.

Coming in 2.0

The semantic layer is the headline. Table maintenance, soft delete, and masking round it out.

Semantic layer

Ossie semantic models, glossary, and domains. One governed definition compiled to SQL for every engine, as the caller.

MCP Gateway

A separate service that governs AI access to anything, narrowing identity to the person behind the agent.

Policy-driven table maintenance

Compaction, manifest rewrite, orphan cleanup, and snapshot expiry run from a policy you set, not a runbook you follow.

Soft delete

Drop an Iceberg table and get a recovery window before it is gone.

Row filtering and column masking

Policy travels with the data into every engine.

Lance permissioning

The same grants on Lance datasets as on tables.

Ready to Federate Your Lakehouse?

Whether your next workload is a Trino query, a Lance training run, or an AI agent asking for metadata, Datastrato gives you one catalog and one governance plane to handle it.

Request a Trial Read the docs

Subscribe to our newsletter

Stay up to date with all things Datastrato and the Gravitino Ecosystem