Trust tiers and medallion architecture: bronze, silver and gold

What the three layers actually are

Bronze

Data as it arrived, unaltered, with whatever mess the source system had. The point is fidelity: if a transformation turns out to be wrong six months later, bronze is what lets you rebuild without going back to the source.

Governance consequence people miss: bronze is where the identifiers live. Because nothing has been cleaned or dropped yet, the raw layer is routinely the most sensitive thing in the estate, full of IP addresses, device identifiers and free-text fields containing things nobody intended to collect. It is also the layer most likely to be left open to the whole analytics team.

Silver

Cleaned, de-duplicated, typed, conformed to shared keys. This is where a customer from three systems becomes one customer, and therefore where most of the interesting decisions get made — and hidden. The matching rules in the silver layer are business policy expressed as code, usually without anyone having agreed the policy.

Gold

Aggregated, shaped for consumption: the tables reports actually read. Gold is where the measures live, which is why an error at this layer propagates instantly to everything a director looks at.

Why gold does not mean correct

The layers describe distance from the source. Nothing in the definition of "gold" says a human checked it, that the measure matches the one the board agreed, or that the data underneath was fit for the purpose it is now being used for.

The characteristic failure: a gold revenue table, built correctly, joining correctly, aggregating correctly — on a definition of revenue that finance stopped using in the last restructure. Every technical check passes. The number is wrong in a way that no pipeline test can catch, and it carries the visual authority of the gold layer while being wrong.

That is the case for a second, separate label.

What a trust tier promises

A trust tier is a statement to a reader, not a description of a pipeline. Three levels work:

The load-bearing part is the third column. A tier that can be self-declared is decoration. Promotion to the top tier should require a named person to sign, on a date, having checked something specific — which is exactly what the medallion layers do not require.

Why not just call them bronze, silver and gold?

Because your finance director is not going to. The medallion names are engineering vocabulary and they carry an implication of quality — gold is obviously better than bronze — that the definition does not support. A business-facing label should say what a reader may do with the data, in words that mean the same thing to an accountant and an engineer.

Keep the medallion names in the platform where they belong, and map them once, publicly, so nobody has to guess:

• Bronze tables are almost always Raw.
• Silver tables are usually Conformed, and sometimes still Raw if the conforming rules are unagreed.
• Gold tables are Conformed until someone signs them off, at which point they become Trusted. Gold does not confer the top tier on its own.

That last line is the whole point of running two ladders.

Making promotion mean something

Write a short promotion procedure and hold to it. Ours has five checks, and they are deliberately dull:

1. The definition is written down in business terms and the owner agrees with it.
2. The quality rules run on a schedule and their current results are visible.
3. The figure has been reconciled against an independent source at least once, and the reconciliation is dated.
4. An owner has signed the promotion, by name, on a date.
5. A review date is set — annually, or on any change to the definition or the upstream schema.

Demotion needs to be possible too, and used. The first time a trusted dataset is publicly moved back to Conformed because its steward left and the checks stopped running, the tier stops being decorative for everyone watching.

If you have no lakehouse at all

Plenty of businesses reading this run Power BI on top of application databases with no medallion anything. The tiers still work, and arguably work better, because they attach to reports rather than tables: this dashboard is Trusted, that one is somebody's working analysis. Labelling the twenty most-viewed reports in your tenant is a week's work and removes a category of argument permanently.