External effects and attestations

Fabric Platform governs the intent and evidence of an external mutation. Integration packages own provider authentication and service APIs. For Databricks, use @fabric-harness/databricks; do not implement workspace clients inside a vertical application.

The portable governance contract records five related concepts:

• MutationFootprint declares the resources and operations approved before execution.
• ExecutionPrincipal preserves the effective principal and its delegation chain.
• PolicyObligation makes required evidence or controls durable and enforceable.
• ExecutionAttestation links the invocation to provider-side operation evidence.
• ExternalReconciliation records later observations when an external outcome was uncertain.

import type { MutationGovernanceResolver } from "@fabricorg/platform/governance";

const resolveMutationGovernance: MutationGovernanceResolver = (input) => ({
  footprint: {
    version: 1,
    resources: [{
      resource: { provider: "data-platform", resourceType: "table", resourceId: "sales.orders" },
      operation: "update",
    }],
  },
  executionPrincipal: {
    principalId: "service-principal-a",
    principalType: "service_account",
    delegatedBy: { principalId: input.actorId, principalType: input.actorType },
  },
});

@fabricorg/platform-host persists this context after schema validation and before HITL and policy execution. Successful adapters can return attestations that satisfy named obligations. Required obligations that remain pending or failed prevent the invocation from completing.

Provider credentials, bearer tokens, connection strings, and raw sensitive payloads must never be placed in footprints, attestations, reconciliation records, or evidence references.

Databricks composition

Databricks identity, SQL, Jobs, Lakeflow, Unity Catalog, AI Gateway, Model Serving, MLflow, Lakebase, System Tables, Volumes, and Apps belong to Fabric Harness. A vertical declares business intent and imports Harness's public implementation. Platform remains independently usable with any provider.