Model contracts and access controls in dbt - Step-by-Step Execution

Concept Flow - Model contracts and access controls

Define Model Contract

↓

Specify Input Schema

↓

Specify Output Schema

↓

Implement Model Logic

↓

Apply Access Controls

↓

Run dbt Model

↓

Validate Contract Compliance

↓

Grant or Deny Data Access

This flow shows how a dbt model contract is defined with input/output schemas, then access controls are applied before running and validating the model.

Execution Sample

dbt

version: 2
models:
  - name: sales_summary
    columns:
      - name: total_sales
        tests:
          - not_null
          - accepted_values:
              values: [0, 1000000]

This dbt schema.yml snippet defines a model contract for 'sales_summary' with column tests to enforce data quality.

Execution Table

Step	Action	Input Schema Check	Output Schema Check	Access Control Check	Result
1	Start dbt run	N/A	N/A	N/A	Running model
2	Check input schema matches contract	Pass	N/A	N/A	Input schema valid
3	Run model SQL logic	N/A	N/A	N/A	Model executed
4	Check output schema matches contract	N/A	Pass	N/A	Output schema valid
5	Apply access controls	N/A	N/A	User has permission	Access granted
6	Complete run	N/A	N/A	N/A	Model run successful
7	If access denied	N/A	N/A	User lacks permission	Access denied - stop

💡 Execution stops if access control check fails or after successful model run and validation

Variable Tracker

Variable	Start	After Step 2	After Step 4	After Step 5	Final
input_schema_valid	undefined	True	True	True	True
output_schema_valid	undefined	undefined	True	True	True
user_access	undefined	undefined	undefined	True or False	True or False
model_run_status	Not started	Not started	Running	Running	Success or Denied

Key Moments - 3 Insights

Why does the model run stop if access control fails?

Because the execution_table row 7 shows that if the user lacks permission, access is denied and the process stops to protect data.

What happens if the output schema does not match the contract?

The output schema check in row 4 would fail, causing the model run to fail or raise an error to ensure data quality.

How do input and output schema checks help in model contracts?

They ensure the data going in and coming out matches expected formats, preventing errors and maintaining trust in data pipelines as shown in rows 2 and 4.

Visual Quiz - 3 Questions

Look at the execution table, what is the result after step 4?

A Output schema valid

B Access denied

C Input schema invalid

D Model not started

💡 Hint

Check the 'Result' column in row 4 of the execution_table

At which step does the access control check happen?

A Step 2

B Step 5

C Step 4

D Step 7

💡 Hint

Look at the 'Action' column for access control in the execution_table

If the user lacks permission, what happens to model_run_status in variable_tracker?

A Changes to 'Success'

B Remains 'Running'

C Changes to 'Denied'

D Changes to 'Not started'

💡 Hint

Refer to 'model_run_status' variable in variable_tracker after step 5

Concept Snapshot

Model contracts in dbt define expected input/output schemas.
Access controls restrict who can run or see model data.
Schema checks validate data shape before and after model runs.
Access denied stops model execution to protect data.
Contracts ensure data quality and trust in pipelines.

Full Transcript

In dbt, model contracts define the expected input and output data shapes using schema files. When running a model, dbt first checks if the input data matches the contract. Then it runs the model's SQL logic. After that, it checks if the output data matches the expected schema. Access controls are applied to ensure only authorized users can run or see the model data. If access is denied, the model run stops immediately to protect data. This process helps maintain data quality and security in data pipelines.