# How It All Works Together — A Tiny Tour of Maxim's Fabric Building

Same office-building idea as before, but now we'll actually **walk the floors** and watch the data move. We're using a pretend version of Maxim Crane's setup with two business domains (Finance and Operations) and a shared raw-data area.

---

## The Building

Six rooms (workspaces), each one a small department:

| Floor | Room (Workspace) | What's Inside | Robot Living There |
|---|---|---|---|
| 🅑 Basement | `Bronze-Landing` | A **Lakehouse** holding raw files; **Connections** to outside data sources | 🤖 `Bronze-Bot` |
| 🅢 1st floor | `Silver-Curated` | A **Lakehouse** holding cleaned data; **Notebooks** that do the cleaning | 🤖 `Silver-Bot` |
| 🅖 2nd floor — west | `Gold-Finance` | A **Warehouse** of Finance marts; a **Data Pipeline** that orchestrates loads | 🤖 `Finance-Bot` |
| 🅖 2nd floor — east | `Gold-Operations` | A **Warehouse** of Ops marts; a **Data Pipeline** | 🤖 `Ops-Bot` |
| 📊 3rd floor — west | `Reporting-Finance` | Semantic models + reports for the Finance team | 🤖 `ReportFin-Bot` |
| 📊 3rd floor — east | `Reporting-Operations` | Semantic models + reports for the Ops team | 🤖 `ReportOps-Bot` |

Each room has **one robot** living in it. The robot's only job: fetch stuff from rooms above/below so the artifacts in its room can do their work.

---

## The Daily Flow (How Data Moves Upstairs)

```
   🌐 Outside sources (on-prem SQL, ADLS, APIs)
                ↓ uses [Prod] Connection
   🅑 Bronze-Landing
       🤖 Bronze-Bot pulls raw → drops in lh_bronze
                ↓
   🅢 Silver-Curated
       🤖 Silver-Bot reads lh_bronze
       📓 Notebook cleans → writes to lh_silver
                ↓                     ↓
   🅖 Gold-Finance           🅖 Gold-Operations
       🤖 Finance-Bot            🤖 Ops-Bot
       reads lh_silver           reads lh_silver
       🔁 Pipeline loads         🔁 Pipeline loads
       → wh_finance              → wh_ops
                ↓                     ↓
   📊 Reporting-Finance      📊 Reporting-Operations
       🤖 ReportFin-Bot          🤖 ReportOps-Bot
       reads wh_finance          reads wh_ops
       📈 Reports refresh        📈 Reports refresh
                ↓                     ↓
   👥 Finance-Viewers        👥 Ops-Viewers
       open the door             open the door
       (humans wearing           (humans wearing
        the right badge)          the right badge)
```

Notice: data flows **up** the building. Robots fetch from the floor below. Humans only enter on the top floor.

---

## Meet the Robots and Their Badges

Each robot wears badges that open doors. Some badges open **other rooms in the building** (other Fabric workspaces). Some open **doors in the outside world** (Azure resources).

| Robot | Lives In | Wears These Badges | So It Can Reach… |
|---|---|---|---|
| 🤖 `Bronze-Bot` | Bronze-Landing | `Conn-OnPremSQL-Readers`, `Conn-ADLS-RawDrops-Writers` | On-prem SQL, the raw-drops lake outside |
| 🤖 `Silver-Bot` | Silver-Curated | *Viewer on Bronze-Landing workspace* | The `lh_bronze` lakehouse |
| 🤖 `Finance-Bot` | Gold-Finance | *Viewer on Silver-Curated*, `Conn-KeyVault-Maxim-Readers` | The `lh_silver` lakehouse + secrets |
| 🤖 `Ops-Bot` | Gold-Operations | *Viewer on Silver-Curated*, `Conn-KeyVault-Maxim-Readers` | The `lh_silver` lakehouse + secrets |
| 🤖 `ReportFin-Bot` | Reporting-Finance | *Viewer on Gold-Finance* | The `wh_finance` warehouse |
| 🤖 `ReportOps-Bot` | Reporting-Operations | *Viewer on Gold-Operations* | The `wh_ops` warehouse |

> 💡 **Key idea:** A robot's badge for *another Fabric workspace* is just Manage Access on that workspace. A robot's badge for *outside the building* is membership in an Entra group that holds Azure RBAC.

---

## Meet the People Buckets

| Bucket (Entra Group) | Who's In It | What Doors It Opens |
|---|---|---|
| 👥 `Fabric-Platform-Engineers` | Data platform team | Admin on every workspace — they keep the building running |
| 👥 `Fabric-Finance-Analysts` | Finance power users | Contributor on `Gold-Finance` and `Reporting-Finance` — can build reports |
| 👥 `Fabric-Finance-Viewers` | Finance business users | Viewer on `Reporting-Finance` — can only read |
| 👥 `Fabric-Ops-Analysts` | Ops power users | Contributor on `Gold-Operations` and `Reporting-Operations` |
| 👥 `Fabric-Ops-Viewers` | Ops business users | Viewer on `Reporting-Operations` |

A Finance Viewer **cannot** see Operations reports. A Finance Analyst **cannot** edit raw data in Bronze. Each badge opens only its own doors.

---

## Meet the Shared Connections

A **Connection** is like a labeled extension cord plugged into an outside building. We name them carefully so nobody plugs in a second one by mistake.

| Connection Name | Plugs Into | Authenticates As | Used By |
|---|---|---|---|
| `[Prod] OnPremSQL – CraneOps` | On-prem SQL Server | Workspace Identity (via gateway) | Bronze-Bot |
| `[Prod] ADLS – RawDrops` | Azure Data Lake | Workspace Identity | Bronze-Bot |
| `[Prod] KeyVault – Maxim` | Azure Key Vault | Workspace Identity | Finance-Bot, Ops-Bot |

Each connection is **shared** — defined once, reused everywhere. No duplicates floating around with slightly different names.

---

## Five Quick Stories

### 📖 Story 1: A new Finance analyst joins

1. IT drops her into `Fabric-Finance-Analysts` in Entra.
2. Within minutes she can open `Gold-Finance`, `Reporting-Finance`, build new reports, and view dashboards.
3. She **cannot** see Operations or raw data. Her badge doesn't open those doors.

**Cost to set up:** one click. **Cost to remove her later:** also one click.

---

### 📖 Story 2: Morning data refresh

5:00 AM — the Pipeline in `Gold-Finance` wakes up:

1. 🔁 Pipeline tells `Finance-Bot` to go fetch fresh data from `Silver-Curated`.
2. 🤖 `Finance-Bot` walks to Silver (its badge says it's a Viewer there), reads `lh_silver`, returns home, loads `wh_finance`.
3. Meanwhile, an earlier upstream job had `Silver-Bot` read from `Bronze-Landing`, which itself had `Bronze-Bot` pull from on-prem SQL using the shared connection.
4. By 6:00 AM all three floors have fresh data. Finance analysts open their morning reports — robots already did the work.

No human typed a password. No credential was stored in a notebook. Each robot only had access to the *one* floor below it.

---

### 📖 Story 3: A notebook needs data from BOTH Finance and Ops

The platform team wants to build a cross-domain notebook in a new room called `Analytics-CrossDomain`.

1. Create the workspace and its robot, 🤖 `Cross-Bot`.
2. Add `Cross-Bot` as a **Viewer** on both `Gold-Finance` and `Gold-Operations` (two Manage Access adds).
3. The notebook opens connections to both warehouses using Workspace Identity auth.
4. Done. No new secrets. No new connection strings. Two badge grants.

If later we want to revoke its access to Finance, we remove `Cross-Bot` from the `Gold-Finance` Manage Access list. Ops access is unaffected.

---

### 📖 Story 4: Promoting a pipeline from Dev to Prod

Same building exists three times: Dev, Test, Prod. Same robot names, same group names — just different rooms.

- 👥 `Fabric-Platform-Engineers` are Admins on Dev, Test, **and** Prod.
- 👥 `Fabric-Finance-Analysts` are Contributors on Dev and Test, but only **Viewers** on Prod.
- Only the small `Fabric-Prod-Deployers` group can promote Test → Prod.

So an analyst can experiment freely in Dev, hand off to the deployer group, and never accidentally push something live. The badges enforce the speed limit.

---

### 📖 Story 5: A workspace gets retired

`Gold-Operations` is being replaced by a redesigned version. We delete the old room.

- 🤖 `Ops-Bot` vanishes automatically — it was part of the room.
- Its membership in `Conn-KeyVault-Maxim-Readers` automatically goes away too.
- Key Vault and ADLS see **no orphaned principals** in their access lists. The group still exists, just with one fewer member.
- We build the new workspace, create its new robot, drop the new robot into the same groups. Everything else is untouched.

Clean teardown. Clean rebuild. No Azure portal cleanup required.

---

## What to Remember

1. **One robot per workspace.** Each workspace gets its own Workspace Identity. The robot's badges decide what *that* workspace can reach.
2. **Robots travel upstream only.** Bronze → Silver → Gold → Reporting. Higher-floor robots reach down; lower-floor robots never reach up.
3. **People only walk in at the top.** Business users belong on Reporting floors. Analysts get Gold. Engineers get the basement. Nobody gets everything just because.
4. **Connections are named, shared, and reused.** One `[Prod] OnPremSQL – CraneOps`, used by whichever robot needs it. No duplicates.
5. **Badges (groups) hold the permissions, not the badge-wearers.** Add/remove members in Entra. Doors don't need to change.

That's the whole building. 🏢