Chapter 6 of 6
Confirm the result#
Intended path#
Sign in as the permitted consumer identity from access-check-plan.json. Run the approved read-only query through the selected consumer path, such as the lakehouse, SQL endpoint, semantic model, or Fabric data agent. The result must match the expected allowed result shape recorded in the customer-owned copy of the plan.
Blocked path#
Sign in as the restricted consumer identity. Run the same read-only path. The result must match the blocked result recorded in the customer-owned copy of the plan.
Delivery-owner checkpoint#
The delivery owner observes both checks. Keep the DLP policy in simulation mode and leave the lakehouse out of AI grounding use if the restricted identity can read the gold path, if the permitted identity fails, or if either check uses a different item or query path.
After implementation#
| What remains | Owner |
|---|---|
| Copilot and AI tenant settings baseline and drift response | Fabric administrator and baseline owner |
OneLake security role, ETag review, and DefaultReader restricted-principal review | Data access owner |
| Sensitivity label assignment and label policy | Information protection owner |
| Fabric DLP policy in simulation mode, alerts, and match review | Purview operator and policy owner |
| Permitted and restricted access plan | Delivery owner and AI application owner |
Run the tenant-setting drift check after any Fabric tenant-setting change. Run the OneLake role check after any lakehouse role update, group change, or workspace role review.
Restore through the owning service paths:
- Remove the lakehouse from AI grounding configuration if an access check fails.
- Return the DLP policy to Keep it off or keep it in simulation while the Purview operator corrects the scope.
- Reapply the previous OneLake role set with the reviewed ETag if the new role grants too much access.
- Add the restricted group back to
DefaultReaderonly if the data access owner approves that broader access outside this module. - Keep sensitivity labels and Purview alerts that other approved controls use.
Do not delete the lakehouse, workspace, label taxonomy, audit records, or unrelated OneLake roles as part of this module's restore path.