Fabric puts data-agent scope in Git—but column flags are not a security boundary

Microsoft Fabric can now store a data agent’s working configuration in Git, which gives teams a useful review surface for prompts, examples and schema scope. But the serialized format contains a trap: column entries have an is_selected field even though Microsoft says column-level selection is not supported. If a table is selected, the agent receives all of its columns regardless of those column flags.

Review the table boundary, not the column flags

Fabric stores each data source’s configuration in datasource.json. That file includes data-source instructions, a display name and an elements schema map listing tables and columns. At the table level, is_selected: true includes the table and false excludes it. At the column level, the same-looking property does not narrow access: Microsoft’s documentation says all columns in a selected table are included, irrespective of the column value.

That distinction matters in pull-request review. A diff that appears to turn off a sensitive column can still leave it available to the agent if its parent table remains selected. Treat a newly selected table as the material scope change, and verify the underlying warehouse, lakehouse or semantic-model permissions separately. The repository representation is configuration evidence; it does not replace source-system controls.

Put the whole behavior package through review

Fabric’s Git integration captures more than schema selection. Agent-level instructions are stored in stage_config.json; data-source instructions and schema choices live in datasource.json; example question-query pairs live in fewshots.json. Draft and published versions occupy separate folders, and Microsoft advises teams not to edit the published folder directly. Changes should land in the draft and flow into the published copy through the product’s publishing process.

A practical approval gate should therefore review four things together:

• newly selected or removed tables;
• changes to agent and data-source instructions;
• added or modified example SQL or KQL;
• the generated difference between draft and published state.

Reviewing only the prompt misses schema expansion. Reviewing only schema misses an example query that teaches the agent a new join or interpretation.

Test promotion as well as versioning

The source-control feature is still in preview. Fabric supports workspace-level Git integration with GitHub or Azure DevOps, plus deployment pipelines across development, test and production workspaces. It also supports batch import and export of item definitions in preview. Service principals are supported only for these ALM operations, not for general interaction with a data agent.

The operational takeaway is straightforward: Git gives teams a change record, not proof that the promoted agent behaves safely. Make table-scope review explicit, run representative and adversarial questions in the test workspace, and confirm the published configuration after promotion. Until Fabric supports actual column-level selection, protect sensitive fields below the agent—through curated tables, views, semantic models and data-platform permissions.