Agentic Governance Blueprint for Fabric — Challenges at a Glance

A visual, one-page-per-eye-movement tour of the 10 challenges that make up the Agentic Governance Blueprint for Fabric. Use this deck-style document when introducing the blueprint to customers, sponsors, or new participants.

1. The blueprint in one picture

flowchart TD
    classDef foundation fill:#0B5394,stroke:#0B5394,color:#fff
    classDef core fill:#1155CC,stroke:#1155CC,color:#fff
    classDef governed fill:#0F9D58,stroke:#0F9D58,color:#fff
    classDef intelligent fill:#FF8A00,stroke:#FF8A00,color:#fff
    classDef capstone fill:#6A329F,stroke:#6A329F,color:#fff

    C00["🔐 00 — Setup<br/>Tenant · Identity · MCP · Skills"]:::foundation
    C01["📦 01 — Workspace as Code<br/>PR → validate → provision → drift"]:::core

    C02["🧱 02 — Items as Code<br/>Lakehouses · Notebooks · Warehouses"]:::governed
    C03["🌐 03 — Domains, Capacities, Sensitivity<br/>Tenant geography · Purview labels"]:::governed
    C04["👥 04 — Access &amp; RBAC Lifecycle<br/>Group-first · Expiring · JIT"]:::governed
    C05["🥇 05 — Medallion Bootstrap<br/>Bronze → Silver → Gold in one PR"]:::intelligent
    C06["🤖 06 — Data Agent Governance<br/>Allow-listed sources · RAI lint"]:::intelligent
    C07["📊 07 — Audit &amp; Observability<br/>Eventhouse · Dashboard · Activator"]:::intelligent
    C08["🚀 08 — Deployment Pipelines<br/>dev → stg → prd · rollback"]:::intelligent

    CAP["🏆 Capstone<br/>One business scenario, end-to-end"]:::capstone

    C00 --> C01
    C01 --> C02
    C01 --> C03
    C01 --> C04
    C02 --> C05
    C02 --> C07
    C02 --> C08
    C03 --> C06
    C04 --> C06

    C02 --> CAP
    C03 --> CAP
    C04 --> CAP
    C05 --> CAP
    C06 --> CAP
    C07 --> CAP
    C08 --> CAP

Legend

2. The 10 challenges, one card each

🔐 00 — Setup

Tenant, identity, and tooling are wired up. The agent can talk to Fabric.

📦 01 — Workspace as Code

Nothing exists in the tenant unless a YAML manifest for it lives in main.

🧱 02 — Items as Code

Governance reaches inside the workspace: every lakehouse, notebook, warehouse is declared.

🌐 03 — Domains, Capacities, Sensitivity

Every workspace lands in the right domain, on the right capacity, with the right label.

👥 04 — Access & RBAC Lifecycle

Group-first, expiring assignments, JIT break-glass, quarterly access reviews.

🥇 05 — Medallion Bootstrap

One PR scaffolds a fully governed Bronze / Silver / Gold lakehouse set.

🤖 06 — Fabric Data Agent Governance

Natural-language Q&A agents, but only over allow-listed sources with RAI-linted instructions.

📊 07 — Audit & Observability

Every governance event lands in an Eventhouse, surfaces in Power BI, trips Activator alerts.

🚀 08 — Deployment Pipelines

dev → stg → prd promotion via Fabric pipelines, gated by PR labels and the same environment approval.

🏆 Capstone — End-to-end integration

One PR (or short stacked series) exercises every challenge the team completed.

3. The four governance layers

flowchart LR
    classDef foundation fill:#0B5394,stroke:#0B5394,color:#fff
    classDef core fill:#1155CC,stroke:#1155CC,color:#fff
    classDef governed fill:#0F9D58,stroke:#0F9D58,color:#fff
    classDef intelligent fill:#FF8A00,stroke:#FF8A00,color:#fff

    subgraph L1["Layer 1 · Foundation"]
        direction TB
        F00["00 — Setup"]:::foundation
    end
    subgraph L2["Layer 2 · Core loop"]
        direction TB
        F01["01 — Workspace as Code"]:::core
    end
    subgraph L3["Layer 3 · Governed control plane"]
        direction TB
        F02["02 — Items"]:::governed
        F03["03 — Domains/Capacities/Labels"]:::governed
        F04["04 — Access & RBAC"]:::governed
    end
    subgraph L4["Layer 4 · Intelligent governance"]
        direction TB
        F05["05 — Medallion"]:::intelligent
        F06["06 — Data Agents"]:::intelligent
        F07["07 — Audit & Observability"]:::intelligent
        F08["08 — Deployment Pipelines"]:::intelligent
    end

    L1 --> L2 --> L3 --> L4

4. Customer outcomes mapped to challenges

5. Suggested adoption paths

Pick the path that matches your starting posture. All paths share the same first two steps (Challenges 00 and 01) — that's the irreducible core.

Path A — Regulated enterprise, governance-first

flowchart LR
    A0(["00<br/>Setup"]) --> A1(["01<br/>Workspaces"])
    A1 --> A3(["03<br/>Domains·Labels"])
    A3 --> A4(["04<br/>RBAC"])
    A4 --> A7(["07<br/>Audit"])
    A7 --> AC(["Capstone"])

Story: "We need to prove control before we scale workloads." Skips items/medallion until the control plane is hardened.

Path B — Data-platform team, delivery-first

flowchart LR
    B0(["00<br/>Setup"]) --> B1(["01<br/>Workspaces"])
    B1 --> B2(["02<br/>Items"])
    B2 --> B5(["05<br/>Medallion"])
    B5 --> B8(["08<br/>Pipelines"])
    B8 --> BC(["Capstone"])

Story: "We need to ship a governed medallion stack for a new business line by Q-end." Adds RBAC and audit in a second wave.

Path C — AI-forward enterprise

flowchart LR
    C0(["00<br/>Setup"]) --> C1(["01<br/>Workspaces"])
    C1 --> C2(["02<br/>Items"])
    C2 --> C3(["03<br/>Labels"])
    C3 --> C4(["04<br/>RBAC"])
    C4 --> C6(["06<br/>Data Agents"])
    C6 --> CC(["Capstone"])

Story: "We want governed Copilot-style Q&A over our data, and we need the guardrails before the first agent ships."

Path D — Full blueprint (2-day RVAS)

00 → 01 → (02 + 03 + 04 in parallel by sub-teams) → (05 + 07 + 08 in parallel) → 06 → Capstone

6. Skills × Challenges matrix

Where Fabric MCP servers and Skills for Fabric show up across the journey.

✅ = used in core tasks · ✳️ = used in stretch goals / optional paths

7. What "done" looks like — maturity journey

timeline
    title Customer maturity progression
    section Foundation
        Day 0 : Empty tenant, ad-hoc ClickOps
    section After 00 + 01
        Week 1 : Identity wired, OIDC live<br/>Workspaces created via PR<br/>Drift detected nightly
    section After 02 + 03 + 04
        Week 3 : Items, domains, labels, RBAC<br/>all flow through PRs<br/>Quarterly access reviews automated
    section After 05 + 08
        Week 5 : Medallion bootstrap as a single PR<br/>dev → stg → prd promotion via pipelines<br/>Rollback in minutes
    section After 06 + 07
        Week 7 : Governed Data Agents live<br/>Real-time governance dashboard<br/>Activator alerts on anomalies
    section Capstone
        Week 8 : One business scenario<br/>delivered end-to-end<br/>through the customer's own governance plane

8. Talking points for executive briefings

Use these four sentences when you have 30 seconds:

"We treat the Fabric tenant as declarative infrastructure. Every workspace, item, role assignment, label, agent, and promotion is a YAML file in Git, reviewed via Pull Request, applied by a service principal with no long-lived secrets. AI agents help authors and reviewers move faster — they never bypass the gate. The blueprint covers 10 challenges that take a team from an empty tenant to a fully governed control plane in under two days."

When you have 3 minutes, add:

• Identity is federated (OIDC) — no client secrets anywhere in CI/CD.
• The validator is the same code path locally and in CI — no surprises.
• Drift runs nightly; out-of-band changes surface as GitHub issues.
• Skills for Fabric ship the heavy lifting (medallion, eventhouse, Power BI, Activator) — we wrap them in the PR loop so the governance frame holds.
• Each delivery feeds the next: customer feedback becomes PRs that add or adapt challenges, so the blueprint compounds value over time.

9. Pointers for deeper reading