(Excerpted from my research paper “Data Mesh and Data Space: A Comparative Analysis with a Focus on Governance.” – Attila Papp, et al. The paper has since been published by Springer—you’ll find the link at the end of the post.)
In the first part of the series, we reviewed where data mesh and data space came from, how they are similar, and how they differ. We promised to pick up where the two paradigms truly diverge in this instalment: governance. The key question is: who sets the rules, and what enforces them—the platform, technically, or the contract, legally?
This is no minor detail. Both approaches decentralize data sharing, so both must address the same dilemma: how can the system remain consistent and trustworthy when no one is sitting in a central control room? The answers that data mesh and data space offer are almost mirror images of each other.
Data mesh: federated computational governance
The data mesh governance model has two levels. At the local level, domain teams govern their own analytical data products—which makes sense, since operational data is also generated in their domains, and they know it best. At the global level, a central governance team ensures that interoperability between teams is maintained. We call this combination federated computational governance.
The “computational” element is the heart of the model: global standards are built into the platform and enforced automatically. So the rules do not live in an intranet PDF; they live in code.
At the local level, the data product owner or data domain steward is responsible for:
- Managing and versioning the data product schema: the team knows its own data best, so this responsibility is in the best hands locally.
- Access management: data-sharing agreements are created at the domain level for use cases, with policies that specify access—including conditions such as expiry and row- or column-level filtering. Approved policies are distributed and enforced automatically.
- Compliance with guidelines defined at the global level.
- Ensuring data quality, data health, and the agreed SLOs.
At the same time, the global governance team:
- defines and enforces enterprise-wide standards: file formats, naming conventions, a shared glossary, security requirements, and data lineage;
- provides guidelines for access-management policies;
- develops methods for managing data quality;
- monitors the availability of the data catalog and data products;
- designs incentives—including gamification—to encourage teams to join the mesh.
In practice, domains often run on different technologies: domain “A” on AWS, “B” on Azure, and “C” perhaps on SAP. In such cases, it is critical that global standards be technology-agnostic: if, for example, an open table format (such as Apache Iceberg) is mandated globally, interoperability is maintained despite differences between the technology stacks—and enforcement remains automatic.
Data space: rulebook and Governance Authority
A data space is built on trust between organizations, so governance here is a framework issue, not a platform issue. Its structure rests on three building blocks: the governance framework (a structured set of principles, processes, and practices), the rulebook that translates it into operational terms, and the Governance Authority—a body or legal entity established by the participants that develops, maintains, and enforces the framework.
Governance also operates on several levels simultaneously:
| Level | What does it govern? |
| Ecosystem | The set of actors and activities governed by local and regional legislation, as well as by market and social conditions. |
| Data space | A defined system whose governance framework is documented in a rulebook and managed by a Governance Authority. |
| Use case | Two or more participants jointly create value by sharing one or more data products—for themselves and, in turn, for the data space and the ecosystem. |
| Participant | An organization committed to the data space governance framework and with a business motivation to participate. |
| Data product | The unit of data sharing, governed by a team within the participant organization and shared as part of use cases. |
(Based on A. Papp et al.)
The most important structural difference is that the data space governance hierarchy is flat. The highest-level decisions are made by an inter-organizational body in which participants have equal rights, and the central elements are agreed by consensus. Data transactions take place peer to peer, without a central data platform. What is platform automation in the mesh is, here, a legally enforceable set of rules. The principle of sovereignty also extends beyond organizational boundaries: data spaces take individuals’ control over their own data seriously, too.
Code or contract? The two models side by side
| Dimension | Data Mesh | Data Space |
| Guiding principle | Efficiency and practicality. | Sovereignty, trust, and legal compliance. |
| Structure | Local + global levels, typically mirroring the corporate hierarchy. | Flat hierarchy: participants with equal rights and decisions made by consensus. |
| Enforcement | Policies built into the platform and enforced automatically (“code”). | A legally enforceable rulebook and contracts (“law”). |
| Decision-maker | A central governance team within the enterprise. | An inter-organizational Governance Authority. |
| Transaction | On a shared (typically cloud) platform. | Peer to peer, without a central platform. |
| Who is empowered | Domain teams within the enterprise. | Organizations—and potentially individuals too. |
(Based on A. Papp et al.)
They also share a common dilemma: finding the balance between disruption and regulation. Data mesh leans toward the technology-driven, disruptive end, while data space leans toward regulation. Neither extreme is viable on its own: mesh needs guardrails too, and data space needs automation—otherwise governance remains on paper.
3 Key Takeaways
- Same goal, different enforcement. Data mesh encodes its rules: policies are built into the platform and enforced automatically. Data space puts them into contracts: the rulebook is legally enforceable. Code vs. law—that is the shortest summary of the two governance models.
- Hierarchy vs. consensus. The local-global structure of data mesh reflects the corporate hierarchy: there is a “higher” level that prescribes standards. There is no such level in a data space: consensus among participants with equal rights and the Governance Authority hold the ecosystem together.
- The two models can learn from each other. Mesh can benefit from the formalized trust framework of data spaces, while data space can benefit from mesh’s automated, computational enforcement. The direction of convergence is clear: hybrid architectures are emerging in which data products from an organization’s internal mesh are exposed directly in an external data space.
What’s next?
That brings the series to an end, but not the research. The next step is to map the points of convergence, conduct a deeper technological comparison, and develop a guideline to help choose between the two paradigms—or their combination—based on the use case.
The full paper has been published by Springer (I4CS 2025): https://doi.org/10.1007/978-3-031-94263-1_10https://doi.org/10.1007/978-3-031-94263-1_10
