OneLake Shortcut + RLS + OneLake Security - 403 / Access denied

[mbn_2025]

Hello,

We are testing a Silver → Gold architecture in Microsoft Fabric where Gold reads Silver through OneLake Shortcuts.
As soon as we enable RLS (SQL Endpoint) together with OneLake Security, queries through the shortcut fail.

What we observe:

• Query works directly in Silver

• Query fails in Gold (table is a shortcut)

SQL endpoint error:

• 403 Forbidden

• UnauthorizedToAccessTableFiles

• Access is denied on table … with a OneLake path to a part-xxxxx.snappy.parquet file

Other symptoms:

• Some objects appear under dbo > Unidentified

• Table sync fails with: table change state is Unknown / Resilience check failed

Our tests / checks:

• Lakehouse item permissions: Read all SQL endpoint data

• OneLake Security configured (at least on Tables/)

Question

Based on these tests and the error details above, can you confirm whether this is a known limitation or bug with cross-workspace OneLake Shortcuts when RLS + OneLake Security are enabled?
If so, what is the recommended configuration/architecture to keep RLS while consuming Silver data from Gold via shortcuts?