OneLake Security: RLS, CLS, OLS Explained

Key insights

• OneLake security centralizes access rules at the data layer so you define access once and have it enforced across lakehouse, warehouse, semantic models, and reports.
  Central enforcement reduces duplicated rules and keeps access consistent across Fabric engines.
• OLS (object-level security) controls which tables or folders a role can access.
  RLS (row-level security) filters which rows a user sees with predicate rules.
  CLS (column-level security) hides specific columns from a user.\b
• Administrators create roles that combine OLS, RLS, and CLS and can apply rules across related tables so filters propagate through model relationships.
  Teams can also import or sync rules from source systems like Snowflake and Databricks, and policies can flow to supported modes such as Direct Lake.
• Feature status matters: RLS is generally available in OneLake, while CLS is still marked preview, so expect maturity and behavior differences across engines.
  Some enforcement paths differ by mode and mixing separate role definitions may cause query errors.
• Key benefits include improved consistency of policy, lower admin work, stronger governance through central auditing, and fine granularity by combining object, row, and column controls.
  Central policies help maintain a single source of truth for access rules.
• Looking ahead, OneLake’s roadmap emphasizes broader engine support and automation and introduces agentic AI skills to let AI agents help configure, audit, and manage security roles.
  This also affects how data engineers with edit access see enforcement applied to their workloads.

Keywords

OneLake security, OneLake row-level security RLS, OneLake column-level security CLS, OneLake object-level security OLS, Fabric Insider Ep 20, Aaron Merrill OneLake, OneLake security deep dive, Fabric OneLake security tutorial