One warehouse, or one per region
The product now operates in regions with data residency requirements: certain personal data may not leave its region. The platform is a single warehouse in one region. Finance needs global revenue; product analytics needs global behaviour; the legal position is not negotiable.
What you would do first
Answer before revealing anything. The value of the exercise is entirely in committing to a diagnosis you can be wrong about.
- 1Classify precisely: which fields are restricted, in which regions, and for which purposes. The restriction almost never covers the aggregates the global consumers need.
- 2Ask each global consumer what they actually need — usually aggregates or pseudonymised behaviour rather than identifiable rows.
- 3Establish what may cross the boundary in what form: aggregated, tokenised, or not at all, and get that in writing rather than inferring it.
- 4Cost the operational reality of running the same platform in several regions: deployment, monitoring, on-call, schema drift between regions, and the divergence that follows.
What is actually going on
The trap
The fix that looks right. Read it even if you got the answer — especially then.
Replicate everything into the central warehouse and restrict access with row-level policies there. The engineering is straightforward and the dashboards work, and the data has already crossed the boundary — which is the thing that was prohibited. An access control on a copy that should not exist does not undo the copy.