fabric-catalog-governancelisted

Audit and remediate Microsoft Fabric governance posture through the REST APIs — what the OneLake catalog Govern tab reports, done by API. Covers domains and subdomains, workspace-to-domain and workspace-to-capacity assignment, domain roles, sensitivity-label coverage and bulkSetLabels, tags, description and endorsement coverage, and item ownership, split by caller tier: Fabric administrator (/v1/admin/*, scanner API) versus data owner (Core API plus workspace, domain or capacity roles). Use when asked to audit governance, find unlabeled, undescribed or unendorsed items or workspaces with no domain, bulk-assign workspaces to a domain, change labels in bulk, or say who can fix a finding. Gates every irreversible write and names the fixes that have no API. For catalog search use fabric-cli (fab find); for workspace roles and OneLake security use fabric-security.
wardawgmalvicious/agent-config · ★ 1 · AI & Automation · score 77

Install: claude install-skill wardawgmalvicious/agent-config

# Governing the Fabric estate The OneLake catalog's **Govern** tab reports a tenant's governance posture across three areas — *Manage your data estate*, *Protect, secure & comply*, and *Discover, trust, and reuse*. This skill does the same work through the REST APIs, where it can be counted, scheduled and fixed in bulk. The output is **findings**, not a rewrite. Do not write to a tenant unless asked separately, and then only through §6. Three neighbours own the adjacent ground: - **Catalog search** — finding an item across workspaces — is the Explore tab. That is `fab find` (`fabric-cli`) and `POST /v1/catalog/search` (`fabric-rest-api`). - **Access** — workspace roles, item permissions, OneLake security, and the shape of the `sensitivityLabel` field including resolving its GUID through Graph — is `fabric-security`. This skill measures label *coverage*; that one explains what a label does. - **REST mechanics** — long-running operations, `continuationToken` pagination, `Retry-After` and 429 handling — is `fabric-rest-api`. Everything below was drilled from Microsoft Learn on 2026-09-11 and **none of it has been exercised against a tenant from this machine**. Treat it as first-party documentation, not as verified practice. ## 1. Establish the caller's tier before anything else **Tier is the API surface the caller can reach, not their job title.** Getting this wrong wastes a whole audit: the endpoints that answer "across the tenant" refuse everyone who is not