---
title: "MDLH: Verify sensitive tag propagation"
url: "https://atlan.com/demos/mdlh-verify-sensitive-tag-propagation/"
excerpt: "Audit whether your PII and Confidential tags actually propagated to every downstream consumer — before your auditors find the gaps."
description: "Verify that your governance taxonomy didn’t silently break at the second hop. Query every tagged source asset, follow propagation through every downstream table and dashboard, and get a clear inheritance percentage at each step. A tag drop isn’t just a hygiene issue — it’s a potential data exposure when access policies are built on those tags. Find the gaps, fix them, and prove compliance across your entire estate in one pass."
format: "Video"
duration: "PT4M28S"
video: "https://videos.ctfassets.net/nwa1c00rtgxb/6h2SNWyszQHDgHLupMPePK/78b29bde0d5066b0ccff5d152df902dc/MDLH_-_Verify_sensitive_tag_propagation.mp4"
thumbnail: "https://images.ctfassets.net/nwa1c00rtgxb/3S9uXeGgGunWokkRclt5s9/f865603f2bae29b156cf33f8e985a142/mdlh-verify-sensitive-tag-propagation.webp"
content_purpose: ["Product Overview"]
target_persona: ["General", "Data Engineer", "Data Analyst", "Data Governance Lead"]
journey_stage: ["S2 - Discovery", "S3 - Solution Design", "S4 - Business Case", "C1 - Onboarding", "C2 - First Value", "C3 - Adoption"]
use_case_context: ["Training"]
product: ["Enterprise Data Graph - Data Lineage"]
published: "2026-03-13"
updated: "2026-06-02"
content_type: "video transcript"
transcript_source: "sheet"
---

# MDLH: Verify sensitive tag propagation

Transcript of the video at https://atlan.com/demos/mdlh-verify-sensitive-tag-propagation/

You tagged a sensitive column at the source. That tag should have propagated to every downstream table. Most teams have no idea if it actually did. Here's the part about tag-based access control that nobody talks about enough: a tag on a source table only protects downstream assets if it actually propagated. Propagation breaks. Quietly. And until you run an audit like this, you don't know where the gaps are — but your auditors will find them. We've done the work — tagged sensitive columns as PII, marked financial tables as Confidential, applied our governance taxonomy at the source.

But here's the question nobody has a clean answer to: did those tags actually make it to every downstream dashboard, every derived table, every BI report that's now serving that data to our stakeholders? Manually checking in the UI means traversing lineage asset by asset. At any real scale, that's not a process — it's a project that never finishes. The Metadata Lakehouse can solve this with a single query. We can get every tagged source asset, every downstream consumer, the propagation status at each hop, the exact tags that were dropped, and a tag inheritance percentage — all in one result set.

Let’s walk through how it works. In Atlan's lineage graph, we can see tag propagation — we can open an asset, look downstream, check what tags are present. But we can only see one asset's lineage at a time. If we have fifty tagged source tables and we want the complete picture across Snowflake, Tableau, and any other tool in our stack — the UI requires fifty separate traversals. There's no "show me all tag gaps" view. That's the gap this use case fills. Since the Metadata Lakehouse is queryable from any compute engine that supports Apache Iceberg, we can build a query to solve exactly this problem — and that's what we'll walk through.

Let's look at how the query is structured. The query uses two parts. The first — tagged_sources — pulls every active asset carrying our governance tags— PII, Confidential, GDPR, HIPAA — and we could customize our own to align to those that matter to our company. The second part joins those source assets to their downstream connections and follows every hop. A depth counter tracks how many hops away each downstream asset is from the original tagged source. Let's run it and see what comes back. Three columns give us exactly what we need for our audit.

One field gives us the at-a-glance verdict — tags propagated, complete tag drop, or tagged differently, meaning the downstream asset has tags but they weren't inherited from the source. Another field tells us exactly which tags were lost at that hop — not just that something went wrong, but what specifically went wrong. And a third field gives us a percentage: 100 means every source tag made it through; anything lower is a gap worth investigating. This gives us a complete look and understanding of our entire estate coverage of our confidential tags in just a few seconds, along with the gaps we need to investigate.

So let’s look at what to do with those gaps once we have them. Once we spot an asset with a complete tag drop — or a low inheritance percentage worth investigating — we navigate to it directly in Atlan. From there we can apply the missing tag manually or check whether lineage propagation was enabled when the tag was attached to the source, We can do this programmatically too through scripting to push back into Atlan using the API's or even apply them via the Atlan MCP. In Atlan, access control policies — Purposes — are built on tags.

If a Confidential tag doesn't propagate from your source table to the Snowflake view built on it, the access policy doesn't apply to the view. A tag drop isn't just a metadata hygiene issue — it's a potential data exposure. That's what this use case is designed to catch before it becomes a problem. And with Atlan’s two way tag sync, if those tags aren’t properly applied in Atlan, the gaps persist in your source like Databricks, meaning your access controls on the source are incomplete too. This is what tag-based policy enforcement actually requires — our tags have to cover every downstream copy of sensitive data, not just the source.

The Metadata Lakehouse is what makes that auditable at scale. We now have a repeatable way to audit tag propagation across every system in our data estate — not just the assets we happened to check manually, but every downstream consumer of every tagged source. The gaps are visible. Now we can actually do something about them. If we want to see how to use the Metadata Lakehouse for root cause analysis — tracing upstream issues in a single query instead of following lineage manually — that walkthrough is linked right here. Drop a comment if your team has run into tag propagation gaps we didn't cover — we read them all.