Skip to content

Omni Connector

The Omni Connector discovers metadata and governs access on your data platforms. It runs on a Runtime Plane and is configured from the Trust3 AI portal. It is separate from the PolicySync connectors, which are configured in Privacera Manager or PrivaceraCloud and are not changed by anything on this page.

  • Efficient metadata discovery: after the first scan, only new or changed objects are fetched in full. Dropped and re-created objects are detected and reflected in the inventory.
  • Reliable access enforcement: policies are translated into each platform's native grants, and only what has changed is applied. If an operation fails, the next sync corrects it. Related grants are batched.
  • Permission drift visibility: the grants that exist on the platform are compared with your policies, and missing or unmanaged access is shown. This check is read-only.
  • Resilient operation: the connector keeps local state, so it recovers from restarts and short interruptions.

Availability

Deployment Omni Connector
Runtime Plane - Self-Managed 🟢 Yes
Runtime Plane - Partially Managed (D2P) 🟢 Yes
Runtime Plane - Trust3 AI Cloud 🔴 Not yet
Privacera Manager (Self-Managed YAML) / PrivaceraCloud 🔴 No. Use the PolicySync connectors.

See the Runtime Plane support matrix for the full list.

Supported platforms

Platform Connector card Object names (FQN) Access audits Event ingestion
Databricks Unity Catalog Databricks Unity Catalog catalog.schema.table 🟢 Yes 🟢 Yes
Databricks SQL (legacy hive metastore) Databricks SQL (Hive Metastore) database.table 🟢 Yes 🟢 Yes
Snowflake Snowflake database.schema.table 🔴 No 🔴 No
Amazon Redshift Redshift database.schema.table 🟢 Yes 🔴 No
AWS Lake Formation Lakeformation Push Mode region.catalogId.database.table 🔴 No 🟢 Yes

Note

Databricks Unity Catalog and Databricks SQL are separate connectors, even for the same workspace. They govern different authorization surfaces, and the Unity Catalog connector ignores the hive metastore. If you have data in both, create one connector of each.

Row filters and column masks

Connector Row Filter Column Masking
Databricks Unity Catalog Yes Yes
Databricks SQL No No
AWS Lake Formation Yes Yes
Snowflake Yes Yes
Amazon Redshift Yes Yes

Deployment mode

You choose the Deployment Mode when you create the connector. It cannot be changed afterwards. To switch, create the connector again.

Mode What runs Use when
Shared (default) The connector settings are added to the Runtime Plane's single omni-connector application. One pod serves every Shared connector. The connectors are trusted together.
Dedicated The connector gets its own application, with its own enable, restart and resource controls. You want a bad connection string or a restart to affect only this connector.

Saving a Shared connector restarts the shared pod

Creating, editing or deleting a Shared connector restarts the shared omni-connector pod. Every Shared connector on the Runtime Plane is briefly interrupted. Batch your edits where you can. Use View status on a Shared connector to open the shared application.

On Self-Managed planes, the Omni Connector is enabled by default. On D2P planes, contact Privacera Support to enable it for your account. The shared application is created when you add your first Shared connector, and removed a few minutes after you delete the last one.

Shared application settings

Settings that apply to the whole shared pod are set once, in the OmniConnector system application under System Applications, and not on each Shared connector.

Field Description
Enable Metadata Service authentication / Metadata Service JWT auth token In the MDS Authentication section, on Self-Managed planes only. See Metadata Service authentication.

A Dedicated connector runs in its own pod, so it has its own values for these settings.

What's next