CLS and RLS reference architectures

Hi SamyAbdul 

You are right that there is no catalog of reference architectures specific to RLS and CLS by business domain in Fabric equivalent to the Azure Architecture Center. What does exist is technical documentation per storage layer, and there is a very relevant update: OneLake Security reached General Availability (GA) on May 5, 2026, which changes some recommendations.

LAYER 1 - OneLake Security (Lakehouse / Eventhouse / Mirrored Databases)

This is the recommended layer because it defines the policy once and enforces it consistently across all engines: Spark notebooks, SQL Analytics Endpoint, Power BI Direct Lake, Fabric Data Agent, and even Excel. With GA it also extends to Eventhouse (KQL) and Mirrored Databases.

https://learn.microsoft.com/en-us/fabric/onelake/security/row-level-security

https://learn.microsoft.com/en-us/fabric/onelake/security/column-level-security

https://learn.microsoft.com/en-us/fabric/onelake/security/data-access-control-model

LAYER 2 - Warehouse and SQL Analytics Endpoint (T-SQL mode)

For scenarios with complex predicate logic, organizational hierarchies, or multitenancy, the classic T-SQL model identical to SQL Server applies: CREATE SECURITY POLICY with predicate functions for RLS, and GRANT/DENY on columns for CLS. This is the most flexible option for dynamic logic based on user identity.

https://learn.microsoft.com/en-us/fabric/data-warehouse/row-level-security

https://learn.microsoft.com/en-us/fabric/data-warehouse/column-level-security

https://learn.microsoft.com/en-us/fabric/data-warehouse/tutorial-row-level-security

LAYER 3 - Semantic Model (Power BI)

RLS and OLS defined in the semantic model using DAX roles. This only protects access via reports. It does not replace the layers above, because a user with direct access to the SQL Endpoint or Lakehouse can bypass this security.

https://learn.microsoft.com/en-us/fabric/security/service-admin-row-level-security

https://learn.microsoft.com/en-us/fabric/security/service-admin-object-level-security

For reference on the full permission model: https://learn.microsoft.com/en-us/fabric/security/permission-model

If this response has been helpful, please don't forget to give it a Like and mark it as a Solution so other community members can find it easily.

Thank you!