Secure enclave inside an enterprise data mesh
Designing and building the secure enclave for the sensitive and secret data domain of a global energy supermajor's Azure data mesh, where governance was the hard part.
- Sector
- Global energy · enterprise data mesh
- Our role
- Security engineering lead
Architecture
Restricted sources
Boundary
Enclave
Published
Consumers
- Azure
- Data mesh
- Data tokenisation
- Custom RBAC
- Private Link
- Key management
- Azure DevOps
The situation
A large organisation running a data mesh has a problem the pattern does not solve on its own: some data cannot sit in the open. PII, commercially sensitive data, and classified data still need to be usable, but not by everyone, and every use has to be provable after the fact. The default answer is that each team builds its own walled platform, which is slow, expensive, and inconsistent. The enclave is the alternative.
Controls at the boundary
The design holds the controls at the edge of the enclave rather than inside every consuming team. Private Link means there is no public path to the data at all. Tokenisation lets sensitive fields move through the platform without exposing the underlying values. A custom role-based access model decides who reaches what, and customer-managed keys mean the organisation, not the platform, holds the encryption. Getting data in requires approval, and everything that happens leaves an audit trail.
Compliance in the architecture
SOX and GDPR were designed into the platform rather than bolted on once it worked. That is a different exercise from passing an audit after the fact: the segregation of duties, the retention rules and the access evidence are properties of how the thing is built, so they hold under scrutiny instead of being reconstructed for it.
How it was governed
Every stage of the design was approved by a Security Architectural Review Board of more than ten members at VP and SVP level. Alongside the build I owned the enclave roadmap and its risk register, kept to a standard that a board of that seniority would sign against. In a regulated estate the review is not overhead around the work. It is the work.
Building something like this?
Book a call