Context is crossing systems faster than authorization policy can follow it

Three enterprise-data launches this week point to the same architectural split: vendors are making data and context easier to move across tools, tenants and catalogs, but the original authorization policy does not necessarily travel with it.

Microsoft’s IQ Sharing preview can expose a whole Fabric lakehouse, warehouse or supported mirrored item to another tenant without copying the data. The package can include Markdown definitions and guidance, but Microsoft says source OneLake security rules are not honored through the share. The shared item and recipient list therefore become the cross-tenant boundary, while recipients need an additional lakehouse-and-shortcut layer before Fabric agents or semantic models can consume the mirrored data. Microsoft’s documentation also says the preview has no SLA and is not recommended for production workloads.

Google’s preview Data Cloud connectors solve a different transport problem with a similar control-plane consequence. Gemini Enterprise can query BigQuery, Spanner, Cloud SQL and AlloyDB in place under the user’s identity, using Knowledge Catalog metadata to discover relevant assets. But Google’s connector documentation says administrators cannot pin a connector to a specific dataset, table or database instance. Existing row- and column-level controls still apply; connector descriptions and custom instructions are guidance, not an authorization boundary. Google directs teams that need deterministic scope toward curated Conversational Analytics data agents with preselected tables, metrics and verified queries.

AWS’s new Iceberg REST catalog federation option makes the opposite move: instead of relying only on a centrally configured IAM role, Glue Data Catalog can accept temporary credentials vended by an external catalog and scoped to its authorized S3 prefix. AWS’s launch notice says Lake Formation can then narrow access further with row- and column-level controls when Athena, EMR, Redshift or Glue queries the federated table. That preserves source-side intent better, but creates two authorization planes whose intersection operators must test.

The common operating rule

These are not equivalent products, but together they expose a useful distinction. Context transport, identity propagation and policy propagation are separate features. A zero-copy share can omit source rules. A connector can preserve user identity while remaining broader than the intended analytical domain. Source-vended credentials can carry a narrow storage grant while a second platform applies additional restrictions.

For data-agent deployments, the practical review should therefore ask four questions independently: what data is reachable, whose identity executes the query, which system makes the final authorization decision, and whether future schema additions automatically expand the reachable surface. If any answer is “the destination,” a successful connection test is not enough; teams need an explicit least-privilege test at the destination boundary.