🏢 A Tiny Tour of Maxim's Fabric Building

Lakehouses, warehouses, notebooks, pipelines, connections — all wired up across domain workspaces

Same office-building idea as the ELI5 doc, but now we'll actually walk the floors and watch the data move. We're using a pretend version of Maxim Crane's setup with two business domains (Finance and Operations) and a shared raw-data area.

The Building

Six rooms (workspaces), each one a small department. Each room has one robot living in it — its job is to fetch stuff from rooms above or below so the things in its own room can do their work.

🅑 BasementBronze-Landing
Lakehouse lh_bronze holding raw files
Connections to outside data sources
🤖 Bronze-Bot
🅢 1st FloorSilver-Curated
Lakehouse lh_silver with cleaned data
Notebooks that do the cleaning
🤖 Silver-Bot
🅖 2nd WestGold-Finance
Warehouse wh_finance with Finance marts
Data Pipeline orchestrating loads
🤖 Finance-Bot
🅖 2nd EastGold-Operations
Warehouse wh_ops with Ops marts
Data Pipeline
🤖 Ops-Bot
📊 3rd WestReporting-Finance
Semantic models + reports for the Finance team
🤖 ReportFin-Bot
📊 3rd EastReporting-Operations
Semantic models + reports for the Ops team
🤖 ReportOps-Bot

The Daily Flow — How Data Moves Upstairs

Data flows up the building. Robots fetch from the floor below. Humans only enter on the top floor.

flowchart TB EXT[🌐 Outside sources
on-prem SQL, ADLS, APIs]:::ext subgraph BRONZE["🅑 Bronze-Landing"] BBOT[🤖 Bronze-Bot] LHB[(lh_bronze
Lakehouse)] end subgraph SILVER["🅢 Silver-Curated"] SBOT[🤖 Silver-Bot] NB[📓 Notebooks
clean & conform] LHS[(lh_silver
Lakehouse)] end subgraph GF["🅖 Gold-Finance"] FBOT[🤖 Finance-Bot] PF[🔁 Pipeline] WHF[(wh_finance
Warehouse)] end subgraph GO["🅖 Gold-Operations"] OBOT[🤖 Ops-Bot] PO[🔁 Pipeline] WHO[(wh_ops
Warehouse)] end subgraph RF["📊 Reporting-Finance"] RFBOT[🤖 ReportFin-Bot] REPF[📈 Reports] end subgraph RO["📊 Reporting-Operations"] ROBOT[🤖 ReportOps-Bot] REPO[📈 Reports] end HUF[👥 Finance-Viewers]:::human HUO[👥 Ops-Viewers]:::human EXT -->|connection| BBOT BBOT --> LHB LHB -.read.-> SBOT SBOT --> NB NB --> LHS LHS -.read.-> FBOT LHS -.read.-> OBOT FBOT --> PF OBOT --> PO PF --> WHF PO --> WHO WHF -.read.-> RFBOT WHO -.read.-> ROBOT RFBOT --> REPF ROBOT --> REPO REPF -.open door.-> HUF REPO -.open door.-> HUO classDef ext fill:#f3f4f6,stroke:#6b7280,color:#111827 classDef human fill:#fce7f3,stroke:#be185d,color:#831843

Meet the Robots and Their Badges

Each robot wears badges that open doors. Some open other rooms in the building (other Fabric workspaces). Some open doors in the outside world (Azure resources).

RobotLives InWears These BadgesSo It Can Reach…
🤖 Bronze-BotBronze-LandingConn-OnPremSQL-Readers
Conn-ADLS-RawDrops-Writers		On-prem SQL, the raw-drops lake outside
🤖 Silver-BotSilver-CuratedViewer on Bronze-LandingThe lh_bronze lakehouse
🤖 Finance-BotGold-FinanceViewer on Silver-Curated
Conn-KeyVault-Maxim-Readers		lh_silver + secrets
🤖 Ops-BotGold-OperationsViewer on Silver-Curated
Conn-KeyVault-Maxim-Readers		lh_silver + secrets
🤖 ReportFin-BotReporting-FinanceViewer on Gold-FinanceThe wh_finance warehouse
🤖 ReportOps-BotReporting-OperationsViewer on Gold-OperationsThe wh_ops warehouse
💡 Key idea: A robot's badge for another Fabric workspace is just Manage Access on that workspace. A robot's badge for outside the building is membership in an Entra group that holds Azure RBAC.

Meet the People Buckets

Bucket (Entra Group)Who's In ItWhat Doors It Opens
👥 Fabric-Platform-EngineersData platform teamAdmin on every workspace — they keep the building running
👥 Fabric-Finance-AnalystsFinance power usersContributor on Gold-Finance and Reporting-Finance — can build reports
👥 Fabric-Finance-ViewersFinance business usersViewer on Reporting-Finance — can only read
👥 Fabric-Ops-AnalystsOps power usersContributor on Gold-Operations and Reporting-Operations
👥 Fabric-Ops-ViewersOps business usersViewer on Reporting-Operations

A Finance Viewer cannot see Operations reports. A Finance Analyst cannot edit raw data in Bronze. Each badge opens only its own doors.

Meet the Shared Connections

A Connection is like a labeled extension cord plugged into an outside building. We name them carefully so nobody plugs in a second one by mistake.

Connection NamePlugs IntoAuthenticates AsUsed By
[Prod] OnPremSQL – CraneOpsOn-prem SQL ServerWorkspace Identity (via gateway)Bronze-Bot
[Prod] ADLS – RawDropsAzure Data LakeWorkspace IdentityBronze-Bot
[Prod] KeyVault – MaximAzure Key VaultWorkspace IdentityFinance-Bot, Ops-Bot

Each connection is shared — defined once, reused everywhere. No duplicates floating around with slightly different names.

Five Quick Stories

📖 Story 1

A new Finance analyst joins

  1. IT drops her into Fabric-Finance-Analysts in Entra.
  2. Within minutes she can open Gold-Finance, Reporting-Finance, build new reports, and view dashboards.
  3. She cannot see Operations or raw data. Her badge doesn't open those doors.

Cost to set up: one click. Cost to remove her later: also one click.

📖 Story 2

Morning data refresh

5:00 AM — the Pipeline in Gold-Finance wakes up:

  1. 🔁 Pipeline tells Finance-Bot to go fetch fresh data from Silver-Curated.
  2. 🤖 Finance-Bot walks to Silver (its badge says it's a Viewer there), reads lh_silver, returns home, loads wh_finance.
  3. Meanwhile, an earlier upstream job had Silver-Bot read from Bronze-Landing, which had Bronze-Bot pull from on-prem SQL using the shared connection.
  4. By 6:00 AM all three floors have fresh data. Finance analysts open their morning reports — robots already did the work.
No human typed a password. No credential was stored in a notebook. Each robot only had access to the one floor below it.
📖 Story 3

A notebook needs data from BOTH Finance and Ops

The platform team wants to build a cross-domain notebook in a new room called Analytics-CrossDomain.

  1. Create the workspace and its robot, 🤖 Cross-Bot.
  2. Add Cross-Bot as a Viewer on both Gold-Finance and Gold-Operations (two Manage Access adds).
  3. The notebook opens connections to both warehouses using Workspace Identity auth.
  4. Done. No new secrets. No new connection strings. Two badge grants.

If later we want to revoke its access to Finance, we remove Cross-Bot from the Gold-Finance Manage Access list. Ops access is unaffected.

📖 Story 4

Promoting a pipeline from Dev to Prod

Same building exists three times: Dev, Test, Prod. Same robot names, same group names — just different rooms.

So an analyst can experiment freely in Dev, hand off to the deployer group, and never accidentally push something live. The badges enforce the speed limit.

📖 Story 5

A workspace gets retired

Gold-Operations is being replaced by a redesigned version. We delete the old room.

Clean teardown. Clean rebuild. No Azure portal cleanup required.

🧠 What to Remember

  1. One robot per workspace. Each workspace gets its own Workspace Identity. The robot's badges decide what that workspace can reach.
  2. Robots travel upstream only. Bronze → Silver → Gold → Reporting. Higher-floor robots reach down; lower-floor robots never reach up.
  3. People only walk in at the top. Business users belong on Reporting floors. Analysts get Gold. Engineers get the basement. Nobody gets everything just because.
  4. Connections are named, shared, and reused. One [Prod] OnPremSQL – CraneOps, used by whichever robot needs it. No duplicates.
  5. Badges (groups) hold the permissions, not the badge-wearers. Add/remove members in Entra. Doors don't need to change.
That's the whole building. 🏢