Enterprise governance

Fabric Experiments connects the evidence produced by A/B experiments and Databricks workload tests to release decisions. Governance is organization scoped and enforced by the API; Studio is not the security boundary.

Start with the safe baseline

1. Create separate organizations for unrelated security boundaries.
2. Give humans the lowest suitable role: viewer, experimenter, admin, or owner.
3. Create expiring Quality publisher keys for CI; do not share personal keys.
4. Publish the suites that must protect production.
5. Open Settings → Governance policy, enable the Quality gate, enter exact suite names, and choose a freshness window.
6. Set evidence retention. Enable legal hold only for an active preservation requirement.
7. Verify the policy in Audit and test a staging-to-production promotion.

Production Quality gate

When enabled, promotion into a production-tier environment requires the latest run for every configured suite to:

• exist in the same organization;
• have status passed; and
• finish within the configured freshness window.

The Configuration screen shows when promotion is blocked, and the API returns 409 QUALITY_GATE_FAILED with each failed check. The server repeats the check at promotion time, so a stale browser or direct API caller cannot bypass it.

Typical required suites are:

Databricks BDD
Databricks live suite
Production data contracts

Suite matching is exact. Publish with a stable name:

fx test publish reports/evidence.json --suite "Databricks BDD"

Retention and legal hold

Retention is configurable from 30 to 3,650 days. Scheduled pruning applies the organization policy. Legal hold suspends automatic event deletion for the organization; disabling it resumes the normal retention calculation.

Legal hold is an operational control, not a complete e-discovery product. Export evidence to your approved archive or SIEM where policy requires independent, immutable storage.

Trace hot-window pruning

Ingested spans are served from a hot store for interactive trace UI and dual-written to the lakehouse, which is the system of record. A scheduled pruning daemon deletes hot-store spans and their annotations past the hot window (14 days by default; FX_TRACE_HOT_WINDOW_DAYS) in bounded batches. Organizations under legal hold are skipped, and every prune records a trace.retention_pruned audit event with per-organization counts. Lakehouse trace analytics are unaffected by hot-window pruning.

Unified audit trail

The tenant-scoped Audit screen records experiment lifecycle actions, immutable environment publications and promotions, API-key creation/revocation, Quality run publication, and governance-policy changes. Resource links resolve to the appropriate Experiment, Configuration, Quality, or Settings screen.

Secrets are not written to audit payloads. API keys are stored hashed and shown only once. Quality evidence is redacted at runner capture and again at ingest.

Authorization model

Databricks Apps OAuth and Fabric authorization are independent layers. The gateway grants access to the App; the Fabric session or API key selects an organization and role. Every read and write includes the authenticated organization in its storage predicate.

For deployments that require policy-backed roles, Fabric also has a typed authorization evaluator for versioned custom roles, IdP group bindings, permission simulation, approval-required permissions, and four-hour maximum break-glass grants with two independent approvers. This evaluator is exercised weekly. The hosted Studio role picker remains the fixed four-role surface until the deploying organization explicitly integrates and approves its custom policy; a group name in a JSON file cannot silently grant hosted access.

Signed assurance and immutable retention

The recurring enterprise job creates a CycloneDX production SBOM and a machine-readable control report. The report is signed with Ed25519 and verified against the repository public key. The signed report and SBOM are written to a dedicated Cloudflare R2 archive protected by a seven-year retention lock, then downloaded and hash-verified before the run succeeds.

This Fabric-operated archive protects Fabric's technical certification evidence. Configure customer-owned audit forwarding when the customer must own the retention boundary.

Enterprise readiness boundary

Shipped technical controls include tenant isolation, fixed hosted RBAC roles, typed custom-policy evaluation, SAML/OIDC and SCIM surfaces, 2FA-capable authentication, scoped/expiring API keys, durable audit, retention/legal hold, external audit forwarding, production Quality gates, signed assurance evidence, SBOM generation, retention-locked archival, residency/deletion validation, quota/drift validation, and automated accessibility scanning.

Before a regulated deployment, your team must still validate the chosen IdP, SCIM directory, regional/data-residency design, backup policy, SIEM destination, and incident procedures. Customer-specific custom-policy enforcement, formal compliance certification, and AWS/GCP Databricks certification are not claimed. See the compatibility matrix for the evidence boundary and enterprise security and operations for available controls and customer responsibilities.