Connector Plane UI¶

The Connector Plane UI is the admin UI for the Omni Connector. Use it to see which connectors are connected, what they scanned, which grants were applied, and where the platform differs from your policies.

To open it, go to Settings → Connector Plane in the Trust3 AI portal.

Note

The Connector Plane UI shows what the connectors have reported. You create and configure connectors in the Runtime Plane. See Setup Omni Connector.

Pages¶

The left navigation groups the pages by what you want to know.

Section	Page	Use it to
Connectors	Directory	See every connector, its admission state, liveness and last scan. Trigger a rescan or re-sweep, allow or deny a connector, and edit its scope.
	Activity	Follow metadata scans and permission sweeps (the Connector Runs page).
	Resource Links	Map federated mirror resources to their source.
Resources	Listing	Browse the metadata catalog reported by the connectors.
	Change Events	See what each connector did with every near-real-time change event.
	OMNI Sync	See delivery of governance changes to the Omni Metadata Service.
Access Rules	Access Facts, Definitions, Roles	Browse the grant, row filter and column mask facts, the reusable definitions, and the roles that policies compile to.
	Access Change History	Audit changes to access facts. Append-only, newest first.
	Change Outcomes	See the final outcome of each access-fact change.
	Recompile Queue	See resources waiting for a policy recompile, and re-drain failures.
Workflows	Workflows	Follow each grant, revoke and protection operation sent to a connector.
Grants	Applied Grants, Applied Objects	See what the plane believes is applied on the platform.
	Observed Grants, Grant Drift	See what is actually on the platform, and where it differs from your policies.
	Grant History	See the append-only log of completed grants and revokes.

Common filters¶

Most pages share the same filters:

Connector type and Connector id: narrow the list to one connector. The default shows all connectors.
Pagination: 25, 50 or 100 rows per page.
Timestamps are shown in your browser's time zone.

Tip

Start with the Directory. If a connector is ONLINE and its last scan is OK, move on to the page that matches the symptom in Troubleshooting.

Directory¶

Connectors → Directory lists every connector that has connected to the Connector Plane, identified by its connector ID and type. For a Shared connector, the ID is the connector name you entered in the Runtime Plane, followed by a numeric suffix that Runtime Manager adds, for example dbx-uc-sm-1-30.

Column	Meaning
Connector ID / Type	The connector instance and its platform type, for example `databricks` for Unity Catalog.
Admission	`ALLOWED`, `PENDING` or `DENIED`. See Admission.
Liveness	`ONLINE` when the connector is polling the plane. `OFFLINE` when it has stopped polling. Blank or gray when it has never been seen.
Last scan	The status and time of the last metadata scan the connector reported: `OK`, `PARTIAL` or `FAILED`. A dash means no scan has been reported.
First seen	When the connector first connected.

Actions¶

Action	What it does
Scope	Opens the managed resources scope of the connector: Include, Exclude and Resource types governed. It is the same scope as the Managed Resources section in the Runtime Plane connector form. See Managed resources.
Links	Opens Resource Links for the connector.
Rescan	Triggers a metadata scan on the connector now. A message links to the run in Activity.
Re-sweep	Triggers a permission sweep now. It reads the real grants from the platform.
Allow / Deny	Sets the admission state.
Resources	Opens the resources of the connector.

Note

Rescan and Re-sweep ask the connector to run now, so they work even when the scheduled scan and sweep are off. Scheduled runs are off by default. See Scan schedule.

Admission¶

Admission controls whether a connector may claim work from the Connector Plane.

State	Meaning
`ALLOWED`	The connector may claim work. Connectors that already have data are marked `ALLOWED`.
`PENDING`	A newly seen connector. It is not blocked.
`DENIED`	An operator denied it. Its next request for work is rejected with `403`. Work that is already in progress finishes.

Select Deny to stop a connector without redeploying it, and Allow to restore it. Only DENIED blocks a connector.

The Admission column and the Allow and Deny buttons are shown when the Connector Plane reports admission settings.

Resource Links¶

Connectors → Resource Links shows the federation topology: which mirror resources inherit governance from which source resources. Resources under a mirror root are governed like the source root they reflect, with access limited to read. A mirror is, for example, a Databricks foreign catalog that reflects another platform.

Column	Meaning
Mirror connector / Mirror root	The connector and root resource that mirrors another.
Source connector / Source root	The connector and root resource being reflected.

Changes to a link are not applied retroactively. After you edit a link, re-emit the mirror connector, for example with Rescan.

Runs and Resources¶

Connector Runs¶

Connectors → Activity (page title Connector Runs) lists the metadata scans and permission sweeps that connectors reported. Select a run to see its event timeline.

Column	Meaning
Status	`Running`, `OK`, `Partial` or `Failed`.
Kind	Metadata Scan reads the resources. Permission Sweep reads the grants that exist on the platform.
Connector	The connector that ran it.
Started / Ended	When the run began and finished.
Resources / Events	How many resources and events the run reported.

Status	Meaning
`Running`	The run started and is reporting progress.
`OK`	The run read everything in scope.
`Partial`	Something could not be read, for example because a permission was missing. The rest was still reported, and the run does not claim success. Open the run to see which objects were skipped and why.
`Failed`	The run stopped. Open the run for the error.

Use the Kind and Status filters to find failed or partial runs.

Resources¶

Resources → Listing is the metadata catalog as last reported by the connectors.

Column	Meaning
Resource FQN / Type	The full name and type of the object, for example `catalog.schema.table`.
Connector	The connector that reported it.
Columns	The number of columns, for tables and views.
Created / Last seen	When the object was created, and when a connector last saw it.

The State filter selects:

State	Meaning
Governed (default)	In the connector's managed scope.
Scoped-out	Out of scope but retained. This is what happens when you narrow the scope. The resource returns to Governed if you widen the scope again.
Dropped	Removed at the source.

Note

A resource that is missing here is usually out of scope, not missing from the platform. Check Scope on the Directory, and remember that a new connector governs nothing until you add an Include entry. See Managed resources.

Grants and Drift¶

The Grants section compares what the Connector Plane applied with what is on the platform.

Page	Shows	Source
Applied Grants	What the plane believes is applied	Updated when a connector confirms a grant or revoke
Observed Grants	What is on the platform	Read by the connector's permission sweep
Grant Drift	Where the two differ	Computed from your policies, applied grants and observed grants

Applied Grants¶

Currently applied grants, one row per principal, privilege and resource. A revoked grant disappears from the list. The page does not show in-flight work. For that, open Workflows.

The list reflects the plane's view, so it can be out of date if someone changed the platform directly. Use Grant Drift to find that.

Applied Objects¶

The platform objects that the connector last applied (for connectors that apply objects such as roles), and the version last written. The Drift column compares them with what the permission sweep observed:

Value	Meaning
In sync	The platform matches what was applied.
`DRIFTED`	The object was edited outside Trust3 AI.
`MISSING`	The object was deleted outside Trust3 AI.
Dash	No sweep has observed it yet.

Observed Grants¶

Grants that are on the platform, as read by the permission sweep. This page is read-only. It shows the platform's truth, including grants made outside Trust3 AI. Use the Principal type filter to narrow the list. If the page is empty, run Re-sweep from the Directory.

Grant Drift¶

Intent-anchored reconciliation: every state except in sync. Drift is detected and shown. It is not corrected automatically.

Drift	Meaning	What to do
`EXTRA`	On the platform but not intended: a manual grant, or what remains of a paused policy.	Revoke it on the platform, or add a policy if it should exist.
`MISSING`	Intended and applied, but a sweep found it absent.	Re-apply. Check whether someone revoked it on the platform.
`NOT APPLIED`	Intended but never applied.	Check Workflows for a failed or waiting workflow for this grant.
`UNCONFIRMED`	Applied, and waiting for the next sweep to confirm it.	Wait for the next sweep, or run Re-sweep.

UNCONFIRMED is normal right after a grant. If the permission sweep schedule is off, it stays until you run Re-sweep. See Scan schedule.

Grant History¶

Append-only log of grant and revoke operations that completed on a platform. It is separate from Applied Grants, which shows current state.

Filter	Meaning
Action	`GRANT` or `REVOKE`.
Outcome	`Applied`, or `Deduped (no-op)` when the grant already existed.
Primary only	On by default. Hides the ancestor grants that are added automatically, such as `USE CATALOG` and `USE SCHEMA`. Turn it off to see them.

Change Outcomes¶

Access Rules → Change Outcomes shows the final outcome of each access-fact change: applied, failed, superseded or no-op. Open a row to trace each item through to the workflow that enforced it. APPLIED means the change reached the applied state.

Workflows¶

A workflow is one operation that the Connector Plane sends to a connector, such as granting a privilege, revoking one, or applying a protection. A connector claims a workflow, runs it on the platform, and reports the result. Workflows lists them all.

Columns¶

Column	Meaning
ID	Short workflow ID. Select to filter by it.
Type / Action	`grant-privilege`, `revoke-privilege` or `apply-protection`, and `GRANT` or `REVOKE` where it applies.
Status	See Status.
Deps	The number of workflows this one is waiting on, or that are waiting on it. A workflow waits on its dependencies, for example a grant waits for the `USE CATALOG` grant it needs.
Binding key	Identifies what the workflow acts on: connector, platform, resource type, resource, principal and privilege. A newer workflow with the same key supersedes an older unfinished one.
Connector	The connector that will run it.
Created by	The component that created it, for example `intent-compiler` for policy changes.
Created at / Updated at / Retries	Timing and the number of retries.

Status¶

Status	Meaning
`PENDING`	Waiting on other workflows to complete.
`READY`	Ready for a connector to claim.
`CLAIMED`	A connector is running it. The connector keeps renewing its claim while it works. If the connector stops, the claim expires and the workflow returns to `READY`.
`COMPLETED`	Done on the platform.
`FAILED`	Failed and will not be retried. The connector classified the error as permanent.
`RETRYING`	Failed with a temporary error. It will be retried after the Retry after time.
`CANCELED`	Canceled, or superseded by a newer workflow. A superseded workflow is marked as such in the Binding key column.

Open a workflow to see its payload, Retry count, Retry after, the connector-reported error classification (permanent means no retry), the error message, and the workflows it depends on or that depend on it.

Filters¶

Filter by status, connector type and connector id, or select an ID, type, binding key or connector in a row to filter by it.

Troubleshooting a grant that did not apply¶

Open Workflows and filter by the connector and the resource or principal in the Binding key.
If the workflow is PENDING, open it and check the workflows it depends on. One of them is failed or waiting.
If it is READY, the connector is not claiming. Check the connector's liveness in the Directory, and its admission state.
If it is RETRYING or FAILED, read the error. A permission error on the platform means the connector's credential cannot grant or revoke on that object. See Prerequisites on the data platform.
If it is COMPLETED, check Grant History and Observed Grants.

Sync and Events¶

Change Events¶

Resources → Change Events is the ledger of what each connector did with every near-real-time metadata change event. Every event is recorded, including no-ops. The page refreshes every 5 seconds. Rows appear once the connector reports them, so allow a short delay. Select a row for detail.

These events come from event ingestion. If event ingestion is off, the page is empty.

Disposition	Meaning
`UPSERTED`	The connector read the resource and updated the inventory.
`DROP_CONFIRMED`	The resource was confirmed gone and removed from the inventory.
`DROP_REJECTED_STILL_LIVE`	The event said the resource was dropped, but it still exists, so it was kept.
`NOT_FOUND`	The resource could not be found.
`DEFERRED`	A temporary condition stopped the event from being handled now. It is retried, and a later row for the same event normally ends as `UPSERTED`.
`OUT_OF_SCOPE`	The resource is outside the connector's managed scope, so it was ignored. See Managed resources.
`DEDUPED_UNCHANGED`	The resource had not changed since the last event.
`ERROR`	The connector could not process the event. This is treated as temporary and retried. The Reason column has the cause.

Use the Disposition filter and the resource filter to find a specific event.

OMNI Sync¶

Resources → OMNI Sync shows outbound notifications to the Omni Metadata Service. Events are written together with the governance change, then delivered at least once. The page refreshes every 5 seconds.

Status	Meaning
`PENDING`	Waiting to be delivered.
`FAILED`	Delivery failed and will be retried.
`SENT`	Delivered and accepted once. It does not mean the resource still exists at the target.
`DEAD`	Delivery failed repeatedly and stopped. Check the Last error.

For each target, the page also shows the age of the oldest undelivered event, how many are in flight, and how many are dead. A Re-emit action sends the connector's full current state to the target again. Use it after you fix the cause of a DEAD event.

Recompile Queue¶

Access Rules → Recompile Queue lists resources that are waiting for their policy to be recompiled after an access change. The page refreshes every 5 seconds. Rows normally disappear within seconds.

Status	Meaning
`Pending`	Waiting to be recompiled.
`Dead-lettered`	Compiling failed repeatedly and stopped at the attempt limit. The Last error column shows why.

Dead-lettered rows stay until you fix the cause and select Re-drain, which retries them. Re-drain applies to the connectors in the current filter, or to all connectors if there is no filter.

Prev topic: Custom Properties
Next topic: Troubleshooting