fabric-catalog

Unified governance for Microsoft Fabric — the missing Unity Catalog.

fabric-catalog is a CLI and Python SDK that unifies governance across Microsoft Fabric, Purview, and Databricks Unity Catalog. Define policies once in YAML. Enforce them everywhere. Search, grant, revoke, trace lineage, and sync permissions — one tool, all backends.

The Problem

Databricks has Unity Catalog: one namespace, one permission model, one CLI. Microsoft has Purview + OneLake Catalog + workspace RBAC + OneLake data access roles — five different systems with five different interaction models that don't behave as a unified whole.

fabric-catalog fixes this. It provides a single policy engine that treats Fabric, Purview, and Databricks as enforcement backends rather than independent products.

Install

pip install fabric-catalog

# With Databricks Unity Catalog support
pip install fabric-catalog[databricks]

# Everything
pip install fabric-catalog[all]

Policy-as-Code

Define your governance posture in YAML. Commit it to git. Review changes in CI. Apply across all backends.

# governance.yaml
version: "1"
policies:
  - name: analysts-read
    assets:
      - pattern: "my-workspace.production-lakehouse.*"
    principals:
      - name: analysts@example.com
        type: group
    level: read
    column_masks:
      - column: ssn
        mask: redact
      - column: account_number
        mask: hash
        except_principals:
          - compliance@example.com
    row_filters:
      - condition: "region = 'US'"
        principals:
          - us-analysts@example.com

# Validate the manifest
fc policy validate governance.yaml

# Preview what changes would be applied (dry run)
fc policy plan governance.yaml

# Apply across Fabric + Purview + Unity Catalog
fc policy apply governance.yaml

The policy compiler decomposes each policy into the correct backend-specific grants: workspace RBAC roles, OneLake data access roles, Purview policies, and UC GRANT statements — automatically.

CLI

# Search across all backends
fc search "customer_transactions"

# List assets
fc ls my_workspace
fc ls my_catalog.my_schema --backend databricks

# View permissions (aggregated across all backends)
fc permissions show my_workspace.lakehouse.customers

# Grant / Revoke
fc grant my_workspace.lakehouse.customers user@example.com read
fc revoke my_workspace.lakehouse.customers user@example.com

# Lineage (merged from Purview + Fabric + UC)
fc lineage my_workspace.lakehouse.customers --direction upstream --depth 3

# Sync permissions between Fabric and Unity Catalog
fc diff --mapping-file mappings.json
fc sync --direction fabric_to_uc --dry-run
fc sync --direction fabric_to_uc --apply

Python SDK

from fabric_catalog.facade import CatalogFacade
from fabric_catalog.models import PermissionLevel

async with CatalogFacade() as catalog:
    # Search everywhere
    results = await catalog.search("transactions")

    # Grant with one command — auto-routes to the right backend
    await catalog.grant(
        "workspace.lakehouse.transactions",
        "analyst@example.com",
        PermissionLevel.READ,
    )

    # Lineage across backends
    lineage = await catalog.lineage("workspace.lakehouse.transactions")

    # UC Bridge: sync permissions
    catalog.add_sync_mapping(
        "workspace.lakehouse.transactions",
        "catalog.schema.transactions",
    )
    report = await catalog.sync(direction="fabric_to_uc", dry_run=True)
    print(report.summary)

MCP Server

fabric-catalog exposes itself as an MCP server, enabling AI agents to discover assets, check permissions, trace lineage, and manage governance through natural language.

Available tools: catalog_search, catalog_get, catalog_permissions, catalog_lineage, catalog_policy_check, catalog_list.

Architecture

┌──────────────────────────────────────────────────┐
│               CLI  (fc)                          │
│   search │ ls │ grant │ revoke │ lineage          │
│   sync │ diff │ policy plan │ policy apply        │
├──────────────────────────────────────────────────┤
│           Policy Engine                          │
│   YAML manifest → compiler → execution plan      │
│   drift detection │ column masks │ row filters    │
├──────────────────────────────────────────────────┤
│            CatalogFacade                         │
│   concurrent fan-out │ merge │ deduplicate        │
├──────────┬──────────┬──────────┬─────────────────┤
│  Fabric  │ Purview  │Databricks│   UC Bridge     │
│  Client  │ Client   │ Client   │ (perm sync)     │
├──────────┴──────────┴──────────┴─────────────────┤
│            Unified Models                        │
│ CatalogAsset │ Permission │ LineageGraph          │
│ GovernancePolicy │ CompiledPlan │ SyncReport      │
├──────────────────────────────────────────────────┤
│            MCP Server                            │
│   AI agent interface for governance              │
└──────────────────────────────────────────────────┘

Backend Capabilities

Example Templates

Industry-specific governance templates are included in examples/:

• energy-governance.yaml — Well data, subsurface engineering, regional access controls
• financial-services-governance.yaml — PII masking, transaction access, compliance overrides
• healthcare-governance.yaml — HIPAA-aligned PHI masking, research de-identification, consent filters

Use these as starting points and adapt to your organization.

Configuration

# Interactive setup
fc config init

# Or set environment variables
export FABRIC_CATALOG_TENANT_ID="..."
export FABRIC_CATALOG_CLIENT_ID="..."
export FABRIC_CATALOG_CLIENT_SECRET="..."
export FABRIC_CATALOG_WORKSPACE_ID="..."
export FABRIC_CATALOG_PURVIEW_ACCOUNT="my-purview-account"
export DATABRICKS_HOST="my-workspace.azuredatabricks.net"
export DATABRICKS_TOKEN="dapi..."

UC Bridge Mappings

Map Fabric assets to their Unity Catalog equivalents for permission sync:

{
  "my_workspace.my_lakehouse.customers": "my_catalog.my_schema.customers",
  "my_workspace.my_lakehouse.transactions": "my_catalog.my_schema.transactions"
}

fc diff --mapping-file mappings.json
fc sync --direction fabric_to_uc --mapping-file mappings.json --apply

License

MIT