Governance & Security Framework

The evidence an enterprise review asks for — OneLake security modelled in Git, applied idempotently; a continuous audit-log export; and a recertification worksheet — as runnable artifacts instead of a slide deck. Matches the Governance docs and the free compliance checklist.

10 files · included with Pro · licensed for use within your organisation

What’s included

security-model.example.json — the OneLake security role model as one PR-reviewable file (members, RLS, CLS, table grants)
provision_onelake_security.py — apply the model idempotently via the Fabric REST API, with a dry-run mode
audit_log_export.py — land the unified audit log in a governed Delta table for SIEM and real retention
access_review.py — granted-vs-actually-used worksheet with READ_WITHOUT_GRANT / GRANTED_BUT_UNUSED flags
setup-workspace-identity.sh — az CLI: role assignment + firewalled-storage trusted access, no stored keys
export-tenant-settings.sh — snapshot admin tenant settings to JSON so config drift shows up in Git
COMPLIANCE-CHECKLIST.md — the review checklist mapped to each artifact, with owner + cadence
CONTROL-MATRIX.md — a per-dataset "who can read this table" template across every layer

File tree

README.md
config/retention-policy.example.json
config/security-model.example.json
docs/COMPLIANCE-CHECKLIST.md
docs/CONTROL-MATRIX.md
notebooks/access_review.py
notebooks/audit_log_export.py
notebooks/provision_onelake_security.py
scripts/export-tenant-settings.sh
scripts/setup-workspace-identity.sh

A working scaffold, not a black box. The OneLake security REST surface is still evolving — every API call is marked # EDIT: with a link to the current reference. Verify against the docs for your tenant and test with a non-privileged account before rollout. Updates for API and Runtime changes are included.