data-governance

Manage Datadog data governance including datasets, reference tables, sensitive data scanning, and access allowlists.

5|2|Updated Mar 9, 2026
One-click install
npx skills add https://github.com/lauhon/pi --skill data-governance-lauhon
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: data-governance
Source: https://github.com/lauhon/pi/tree/main/skills/data-governance
Command: npx skills add https://github.com/lauhon/pi --skill data-governance-lauhon

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Organizations struggle to control who can access sensitive telemetry data, enrich logs with business context, and protect PII across their Datadog environment. This Skill provides a unified agent for implementing comprehensive data governance policies through the Datadog API. ## Core Features & Use Cases - Access Control: Create and manage restricted datasets, IP allowlists, domain allowlists, and resource-level restriction policies for dashboards, monitors, SLOs, and 20+ resource types. - Data Enrichment: Build reference tables from local files or cloud storage (S3, GCS, Azure) to enrich logs with business context, with row-level operations and multipart upload support. - PII Protection: Configure Sensitive Data Scanner groups and rules with standard or custom regex patterns, multiple redaction methods, and sampling rates for GDPR, HIPAA, and PCI-DSS compliance. - Use Case: A security team needs to restrict production log access to the security team only, redact credit card numbers from logs, and limit UI access to the corporate VPN. This Skill guides each API call with correct payloads and permission requirements. ## Quick Start Ask the agent to create a restricted dataset that limits access to production logs to a specific role in your Datadog organization.

Frequently Asked Questions about data-governance

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I restrict access to Datadog logs by team or role?

Create a restricted dataset via the POST /api/v2/datasets endpoint with product_filters defining tag-based filters and principals listing the roles or teams allowed access. Each dataset supports up to 10 tag key:value pairs per product.

How do I redact PII from Datadog logs automatically?

Use the Sensitive Data Scanner API to create scanning groups filtered by query, then add rules with standard patterns or custom regex. Choose redaction methods like hash, replacement_string, or partial replacement to mask detected sensitive data.

Does Datadog IP allowlist block data ingestion?

No, the IP allowlist only restricts access to the Datadog web UI, API endpoints, and authentication endpoints. Intake APIs for metrics, logs, and traces, plus public dashboards and embedded graphs, are not blocked.

What data sources do Datadog reference tables support?

Reference tables support local CSV file upload, Amazon S3, Google Cloud Storage, and Azure Blob Storage with automatic syncing. Read-only sources include Salesforce, ServiceNow, Databricks, and Snowflake.

Why can't I enable the Datadog IP allowlist?

The IP allowlist requires an Enterprise plan and must be enabled by Datadog support before use. You also need the org_management permission, and you should add your current IP before enabling to avoid locking yourself out.

What are the limitations of Datadog datasets?

Datasets are limited to 10 tag key:value pairs per product, only one tag key per telemetry type, and tag values cannot be reused across datasets of the same type. The Datasets API is also in Preview and requires Datadog support access.