Govern in the pipe, not after the load
The usual ELT stack lands raw data first and governs it later — by which time the secret has landed and the bad row is queryable. faucet-stream folds governance into the movement itself, before any write.
The seam where risk lives
A modern ELT stack is assembled from parts: a mover loads raw rows, then a separate layer — dbt tests, Great Expectations, a catalog, a monitor — governs them downstream. Each part is fine; the seam between them is where risk lives. PII lands before it's masked. Bad rows are queryable before the check runs. Drift shows up as a broken model, not a decision at ingest. Lineage is reconstructed after the fact.
Fold it into the movement
faucet-stream runs governance as a stage in the movement path, on every page, before the sink: masking, quality checks, data contracts, schema-drift policy, column-level lineage, and freshness/volume SLAs — each a config block, applied uniformly for every one of the dozens of sinks, with zero per-connector code. The decision — mask this, reject that, quarantine the other — happens before the write, not after.
The guarantee that makes it trustworthy
Masking runs first — before quality, contract, drift, and before a row reaches the sink, the dead-letter queue, or a lineage event. So a quarantined bad row carries the masked payload, and a secret never lands anywhere in the clear. It's fixed in one place and checked by a test in CI — a guarantee, not a convention each connector has to remember.
Read the details
The full model — the ordering proof, the six guardrails, and the honest limits — is in the paper: Governance in the Movement Path.
More on the blog, or read the documentation.