Microsoft’s Fabric SQL skills make the dangerous boundary explicit: query, operate or change

Microsoft has put a useful separation of duties directly into its preview SQL-database skills for Fabric: one skill for changing databases, one for read-only discovery and querying, and one for operational diagnosis. That split matters because “help me with this database” can otherwise slide from inspection into mutation without a clear boundary.

Three intents, three skill bundles

The SQL database skills documentation names the bundles explicitly. sqldb-authoring-cli covers creating or modifying objects and data. sqldb-consumption-cli covers schema discovery and read-only queries. sqldb-operations-cli covers health, performance and reliability investigations.

The authoring guidance tells users to specify the workspace, database, environment, object, schema constraints and whether the assistant should only generate a script or execute it after review. Microsoft recommends beginning with a read-only request, reviewing generated T-SQL, and using transaction handling and rollback plans for changes. For consumption, it recommends metadata inspection, qualified object names, result limits and explicit assumptions. Operations prompts should define the time window, symptom, workload and whether diagnostic collection is allowed.

That is more than prompt-writing advice. It gives teams a practical policy vocabulary: query-only sessions can install or invoke the consumption skill, investigations can remain in the operations lane, and change workflows can require the authoring lane plus human review.

Skills are guidance, not a permission system

The boundary has an important limit. Microsoft says the skills do not bypass Entra authentication, Fabric permissions, SQL permissions or organizational policy. They are reusable instructions loaded into an AI coding tool; they do not execute code by themselves. The coding agent still chooses actions, and whatever identity, tools and permissions it receives govern the real blast radius.

Microsoft’s broader Skills for Fabric overview makes the architecture explicit: skills supply static Markdown guidance about APIs, syntax, authentication and operating patterns, while MCP servers or other tools provide live access. The SQL bundle works with tools including GitHub Copilot CLI, Claude Code, Visual Studio Code, Cursor and other AGENTS.md-compatible clients.

For operators, the implication is straightforward: installing the read-only skill is not enough if the attached identity can write. Match each skill bundle to a least-privileged identity, keep development and production targets separate, and treat generated SQL as proposed code.

A review checklist worth keeping

Microsoft’s own checklist is a reasonable minimum gate: confirm the selected skill; verify workspace, database, schema and object names; inspect destructive operations and transaction behavior; request an impact summary and rollback approach; execute only after review; then validate with a separate read-only query.

The preview does not eliminate agent risk. It does something more immediately useful: it turns an ambiguous database assistant into three named operating modes and makes teams choose which mode—and which credentials—they are actually granting.