Role Based Access Control for Variable Libraries

=== PROBLEM STATEMENT ===

Currently, variable libraries in Microsoft Fabric lack granular access control mechanisms. When developers have access to a workspace, they can view all variables in the variable library, including sensitive information such as database connection strings, API keys and authentication tokens, service principal credentials, storage account keys, third-party connector credentials, and environment-specific configuration values.

This poses significant security risks in enterprise environments where the principle of least privilege should be enforced.

=== BUSINESS IMPACT ===

Security Risks:

• Exposure of sensitive credentials to unauthorized users
• Potential for credential misuse or data breaches
• Compliance violations with regulations like SOC 2, ISO 27001, and GDPR
• Inability to implement proper separation of duties

Operational Challenges:

• Developers cannot be granted workspace access without exposing sensitive variables
• Administrators must create workarounds like multiple workspaces, increasing management overhead
• Audit trails become difficult to maintain when everyone has blanket access
• Hindrance to collaboration due to security concerns

=== PROPOSED SOLUTION ===

Implement a comprehensive role-based access control (RBAC) system for variable libraries with the following capabilities:

1. Variable-Level Permissions

• Admin: Full access to create, read, update, delete, and manage permissions for variables
• Read/Write: Can view and modify variable values but cannot manage permissions
• Read Only: Can view variable values for use in their artifacts
• Use Only: Can reference variables in code/queries without viewing actual values
• No Access: Variable is hidden from the user

1. Group-Based Access Control

• Assign permissions to Azure AD security groups rather than individual users
• Support for nested groups
• Bulk permission management for multiple variables

1. Sensitive Variable Masking

• Option to mark variables as "sensitive" which masks values in the UI (showing only asterisks), prevents copying to clipboard, requires explicit "reveal" action with logged audit trail, and can only be revealed by users with appropriate permissions

1. Variable Categories/Tags

• Ability to categorize variables (e.g., "Development", "Production", "Credentials", "Configuration")
• Apply permissions at the category level for easier management
• Filter and search variables by category

1. Inheritance and Defaults

• Set default permissions for new variables
• Inherit permissions from workspace roles with ability to override
• Option to apply permissions template to multiple variables

1. Audit and Compliance

• Comprehensive audit logging for variable access attempts (successful and failed), permission changes, variable value reads and modifications, and sensitive variable reveals
• Export audit logs for compliance reporting
• Integration with Microsoft Purview for unified compliance management

=== IMPLEMENTATION CONSIDERATIONS ===

User Interface Changes:

• Add "Permissions" tab to variable library interface
• Show permission indicators (lock icons) next to variables in lists
• Provide clear visual distinction between accessible and restricted variables
• Add permission management dialog similar to Power BI dataset permissions

Backward Compatibility:

• Existing variable libraries should default to current behavior (all workspace members have access)
• Provide migration path with warnings before enabling restricted access
• Allow gradual rollout with feature flag

API Support:

• Extend REST API to support permission management
• Add permission validation in variable reference resolution
• Include permission metadata in GET requests