policy-weaver 0.1.0__tar.gz

policy_weaver-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+    MIT License
+
+    Copyright (c) Microsoft Corporation.
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy
+    of this software and associated documentation files (the "Software"), to deal
+    in the Software without restriction, including without limitation the rights
+    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+    copies of the Software, and to permit persons to whom the Software is
+    furnished to do so, subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in all
+    copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+    SOFTWARE

policy_weaver-0.1.0/PKG-INFO

@@ -0,0 +1,87 @@
+Metadata-Version: 2.2
+Name: policy-weaver
+Version: 0.1.0
+Summary: Policy Weaver for Microsoft Fabric
+Author-email: Tonio Lora <tonio.lora@microsoft.com>, Christopher Price <chriprice@microsoft.com>
+License: MIT License
+Project-URL: Homepage, https://github.com/microsoft/Policy-Weaver
+Project-URL: Documentation, https://github.com/microsoft/Policy-Weaver/blob/main/docs/PolicyWeaver.md
+Project-URL: Repository, https://github.com/microsoft/Policy-Weaver.git
+Project-URL: Issues, https://github.com/microsoft/Policy-Weaver/issues
+Keywords: Fabric,Fabric Access Policy,Databricks,BigQuery,Snowflake
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: Intended Audience :: Information Technology
+Classifier: Intended Audience :: System Administrators
+Classifier: Topic :: Software Development
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.8
+Classifier: Programming Language :: Python :: 3.9
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Requires-Python: >=3.11.8
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: azure-identity>=1.19.0
+Requires-Dist: databricks-sdk>=0.40.0
+Requires-Dist: msgraph-sdk>=1.16.0
+Requires-Dist: pydantic>=2.10.5
+Requires-Dist: python-dotenv>=1.0.1
+
+# Policy Weaver 
+
+## Overview
+
+Microsoft Fabric introduced mirroring as a managed, friction-free way of synchronizing data from a diverse set of data & analytic platforms to Fabric via OneLake. 
+
+While mirroring provides all the capabilities required to keep data in sync, data access policies defined by the source system are out-of-scope and must be handled manually. 
+
+Manually handling of these data access policies presents a challenge for ensuring consistent security across the data estate while reducing risks or vulnerabilities associated with out-of-sync security policies.
+
+The Policy Weaver project addresses this by automating the synchronzation of data access policies from source to Fabric in a transparent and auditable mmaner.
+
+Designed as a pluggable framework, Policy Weaver provides connectors that handle the export of access policies from a configured source before applying them to the mirror data within Fabric.
+
+Policy Weaver will initially supports the following sources:
+- [Databricks Unity Catalog]()
+- BigQuery
+- Snowflake
+
+<mark><b>Note:</b>Policy Weaver is limited to read-only policies. Support for row filter and column-masking policies will be added in a future version.</mark>
+
+This project is made available as a Python library and can be run from anywhere with a Python runtime. 
+
+For more information on getting started, please see the [Getting Started]() documentation. 
+
+## OneLake Data Access Roles Overview
+
+Policy Weaver uses OneLake Data Access Roles to coalesce source system security policies into access policies that apply uniformly across the Fabric platform. With Data Access Roles, security policies are defined as  role-based access controls (RBAC) on the data stored in OneLake.
+
+When data is accessed from anywhere within Fabric, the defined RBAC policies are enforced. This means that data whether is accessed from a Notebook, SQL Endpoint or Semantic model the security policies defined by the source system are enforced consistently as expected.
+
+For more details on OneLake Data Access policies, please see official Microsoft documentation: [OneLake Security Overview](https://learn.microsoft.com/en-us/fabric/onelake/security/get-started-security) 
+
+## Contributing
+
+This project welcomes contributions and suggestions.  Most contributions require you to agree to a
+Contributor License Agreement (CLA) declaring that you have the right to, and actually do, grant us
+the rights to use your contribution. For details, visit https://cla.opensource.microsoft.com.
+
+When you submit a pull request, a CLA bot will automatically determine whether you need to provide
+a CLA and decorate the PR appropriately (e.g., status check, comment). Simply follow the instructions
+provided by the bot. You will only need to do this once across all repos using our CLA.
+
+This project has adopted the [Microsoft Open Source Code of Conduct](https://opensource.microsoft.com/codeofconduct/).
+For more information see the [Code of Conduct FAQ](https://opensource.microsoft.com/codeofconduct/faq/) or
+contact [opencode@microsoft.com](mailto:opencode@microsoft.com) with any additional questions or comments.
+
+## Trademarks
+
+This project may contain trademarks or logos for projects, products, or services. Authorized use of Microsoft 
+trademarks or logos is subject to and must follow 
+[Microsoft's Trademark & Brand Guidelines](https://www.microsoft.com/en-us/legal/intellectualproperty/trademarks/usage/general).
+Use of Microsoft trademarks or logos in modified versions of this project must not cause confusion or imply Microsoft sponsorship.
+Any use of third-party trademarks or logos are subject to those third-party's policies.

policy_weaver-0.1.0/README.md

@@ -0,0 +1,54 @@
+# Policy Weaver 
+
+## Overview
+
+Microsoft Fabric introduced mirroring as a managed, friction-free way of synchronizing data from a diverse set of data & analytic platforms to Fabric via OneLake. 
+
+While mirroring provides all the capabilities required to keep data in sync, data access policies defined by the source system are out-of-scope and must be handled manually. 
+
+Manually handling of these data access policies presents a challenge for ensuring consistent security across the data estate while reducing risks or vulnerabilities associated with out-of-sync security policies.
+
+The Policy Weaver project addresses this by automating the synchronzation of data access policies from source to Fabric in a transparent and auditable mmaner.
+
+Designed as a pluggable framework, Policy Weaver provides connectors that handle the export of access policies from a configured source before applying them to the mirror data within Fabric.
+
+Policy Weaver will initially supports the following sources:
+- [Databricks Unity Catalog]()
+- BigQuery
+- Snowflake
+
+<mark><b>Note:</b>Policy Weaver is limited to read-only policies. Support for row filter and column-masking policies will be added in a future version.</mark>
+
+This project is made available as a Python library and can be run from anywhere with a Python runtime. 
+
+For more information on getting started, please see the [Getting Started]() documentation. 
+
+## OneLake Data Access Roles Overview
+
+Policy Weaver uses OneLake Data Access Roles to coalesce source system security policies into access policies that apply uniformly across the Fabric platform. With Data Access Roles, security policies are defined as  role-based access controls (RBAC) on the data stored in OneLake.
+
+When data is accessed from anywhere within Fabric, the defined RBAC policies are enforced. This means that data whether is accessed from a Notebook, SQL Endpoint or Semantic model the security policies defined by the source system are enforced consistently as expected.
+
+For more details on OneLake Data Access policies, please see official Microsoft documentation: [OneLake Security Overview](https://learn.microsoft.com/en-us/fabric/onelake/security/get-started-security) 
+
+## Contributing
+
+This project welcomes contributions and suggestions.  Most contributions require you to agree to a
+Contributor License Agreement (CLA) declaring that you have the right to, and actually do, grant us
+the rights to use your contribution. For details, visit https://cla.opensource.microsoft.com.
+
+When you submit a pull request, a CLA bot will automatically determine whether you need to provide
+a CLA and decorate the PR appropriately (e.g., status check, comment). Simply follow the instructions
+provided by the bot. You will only need to do this once across all repos using our CLA.
+
+This project has adopted the [Microsoft Open Source Code of Conduct](https://opensource.microsoft.com/codeofconduct/).
+For more information see the [Code of Conduct FAQ](https://opensource.microsoft.com/codeofconduct/faq/) or
+contact [opencode@microsoft.com](mailto:opencode@microsoft.com) with any additional questions or comments.
+
+## Trademarks
+
+This project may contain trademarks or logos for projects, products, or services. Authorized use of Microsoft 
+trademarks or logos is subject to and must follow 
+[Microsoft's Trademark & Brand Guidelines](https://www.microsoft.com/en-us/legal/intellectualproperty/trademarks/usage/general).
+Use of Microsoft trademarks or logos in modified versions of this project must not cause confusion or imply Microsoft sponsorship.
+Any use of third-party trademarks or logos are subject to those third-party's policies.

policy_weaver-0.1.0/policy_weaver.egg-info/PKG-INFO

@@ -0,0 +1,87 @@
+Metadata-Version: 2.2
+Name: policy-weaver
+Version: 0.1.0
+Summary: Policy Weaver for Microsoft Fabric
+Author-email: Tonio Lora <tonio.lora@microsoft.com>, Christopher Price <chriprice@microsoft.com>
+License: MIT License
+Project-URL: Homepage, https://github.com/microsoft/Policy-Weaver
+Project-URL: Documentation, https://github.com/microsoft/Policy-Weaver/blob/main/docs/PolicyWeaver.md
+Project-URL: Repository, https://github.com/microsoft/Policy-Weaver.git
+Project-URL: Issues, https://github.com/microsoft/Policy-Weaver/issues
+Keywords: Fabric,Fabric Access Policy,Databricks,BigQuery,Snowflake
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: Intended Audience :: Information Technology
+Classifier: Intended Audience :: System Administrators
+Classifier: Topic :: Software Development
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.8
+Classifier: Programming Language :: Python :: 3.9
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Requires-Python: >=3.11.8
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: azure-identity>=1.19.0
+Requires-Dist: databricks-sdk>=0.40.0
+Requires-Dist: msgraph-sdk>=1.16.0
+Requires-Dist: pydantic>=2.10.5
+Requires-Dist: python-dotenv>=1.0.1
+
+# Policy Weaver 
+
+## Overview
+
+Microsoft Fabric introduced mirroring as a managed, friction-free way of synchronizing data from a diverse set of data & analytic platforms to Fabric via OneLake. 
+
+While mirroring provides all the capabilities required to keep data in sync, data access policies defined by the source system are out-of-scope and must be handled manually. 
+
+Manually handling of these data access policies presents a challenge for ensuring consistent security across the data estate while reducing risks or vulnerabilities associated with out-of-sync security policies.
+
+The Policy Weaver project addresses this by automating the synchronzation of data access policies from source to Fabric in a transparent and auditable mmaner.
+
+Designed as a pluggable framework, Policy Weaver provides connectors that handle the export of access policies from a configured source before applying them to the mirror data within Fabric.
+
+Policy Weaver will initially supports the following sources:
+- [Databricks Unity Catalog]()
+- BigQuery
+- Snowflake
+
+<mark><b>Note:</b>Policy Weaver is limited to read-only policies. Support for row filter and column-masking policies will be added in a future version.</mark>
+
+This project is made available as a Python library and can be run from anywhere with a Python runtime. 
+
+For more information on getting started, please see the [Getting Started]() documentation. 
+
+## OneLake Data Access Roles Overview
+
+Policy Weaver uses OneLake Data Access Roles to coalesce source system security policies into access policies that apply uniformly across the Fabric platform. With Data Access Roles, security policies are defined as  role-based access controls (RBAC) on the data stored in OneLake.
+
+When data is accessed from anywhere within Fabric, the defined RBAC policies are enforced. This means that data whether is accessed from a Notebook, SQL Endpoint or Semantic model the security policies defined by the source system are enforced consistently as expected.
+
+For more details on OneLake Data Access policies, please see official Microsoft documentation: [OneLake Security Overview](https://learn.microsoft.com/en-us/fabric/onelake/security/get-started-security) 
+
+## Contributing
+
+This project welcomes contributions and suggestions.  Most contributions require you to agree to a
+Contributor License Agreement (CLA) declaring that you have the right to, and actually do, grant us
+the rights to use your contribution. For details, visit https://cla.opensource.microsoft.com.
+
+When you submit a pull request, a CLA bot will automatically determine whether you need to provide
+a CLA and decorate the PR appropriately (e.g., status check, comment). Simply follow the instructions
+provided by the bot. You will only need to do this once across all repos using our CLA.
+
+This project has adopted the [Microsoft Open Source Code of Conduct](https://opensource.microsoft.com/codeofconduct/).
+For more information see the [Code of Conduct FAQ](https://opensource.microsoft.com/codeofconduct/faq/) or
+contact [opencode@microsoft.com](mailto:opencode@microsoft.com) with any additional questions or comments.
+
+## Trademarks
+
+This project may contain trademarks or logos for projects, products, or services. Authorized use of Microsoft 
+trademarks or logos is subject to and must follow 
+[Microsoft's Trademark & Brand Guidelines](https://www.microsoft.com/en-us/legal/intellectualproperty/trademarks/usage/general).
+Use of Microsoft trademarks or logos in modified versions of this project must not cause confusion or imply Microsoft sponsorship.
+Any use of third-party trademarks or logos are subject to those third-party's policies.

policy_weaver-0.1.0/policy_weaver.egg-info/SOURCES.txt

@@ -0,0 +1,21 @@
+LICENSE
+README.md
+pyproject.toml
+policy_weaver.egg-info/PKG-INFO
+policy_weaver.egg-info/SOURCES.txt
+policy_weaver.egg-info/dependency_links.txt
+policy_weaver.egg-info/requires.txt
+policy_weaver.egg-info/top_level.txt
+policyweaver/__init__.py
+policyweaver/policyweaver.py
+policyweaver/weavercore.py
+policyweaver/models/__init__.py
+policyweaver/models/common.py
+policyweaver/models/databricksmodel.py
+policyweaver/models/fabricmodel.py
+policyweaver/sources/__init__.py
+policyweaver/sources/databricksclient.py
+policyweaver/support/__init__.py
+policyweaver/support/fabricapiclient.py
+policyweaver/support/microsoftgraphclient.py
+policyweaver/support/restapiclient.py

policy_weaver-0.1.0/policy_weaver.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

policy_weaver-0.1.0/policy_weaver.egg-info/requires.txt

@@ -0,0 +1,5 @@
+azure-identity>=1.19.0
+databricks-sdk>=0.40.0
+msgraph-sdk>=1.16.0
+pydantic>=2.10.5
+python-dotenv>=1.0.1

policy_weaver-0.1.0/policy_weaver.egg-info/top_level.txt

@@ -0,0 +1 @@
+policyweaver

policy_weaver-0.1.0/policyweaver/models/common.py

@@ -0,0 +1,131 @@
+from typing import Optional, List, Any
+from enum import Enum
+from pydantic import BaseModel, Field, ConfigDict
+
+
+class CommonBaseModel(BaseModel):
+    model_config = ConfigDict(
+        populate_by_name=True,
+        use_enum_values=True,
+        arbitrary_types_allowed=True,
+        exclude_unset=True,
+        exclude_none=True,
+    )
+
+    def model_dump(self, **kwargs) -> dict[str, Any]:
+        return super().model_dump(by_alias=True, **kwargs)
+
+    def model_dump_json(self, **kwargs) -> dict[str, Any]:
+        return super().model_dump_json(by_alias=True, **kwargs)
+
+    def __getattr__(self, item):
+        for field, meta in self.model_fields.items():
+            if meta.alias == item:
+                return getattr(self, field)
+        return super().__getattr__(item)
+
+    def _get_alias(self, item_name):
+        for field, meta in self.model_fields.items():
+            if field == item_name:
+                return meta.alias
+
+        return None
+
+
+class CommonBaseEnum(Enum):
+    def __str__(self):
+        return str(self.value)
+
+
+class IamType(str, CommonBaseEnum):
+    USER = "USER"
+    GROUP = "GROUP"
+
+
+class PermissionType(str, CommonBaseEnum):
+    SELECT = "SELECT"
+
+
+class PermissionState(str, CommonBaseEnum):
+    GRANT = "GRANT"
+
+
+class PolicyWeaverConnectorType(str, CommonBaseEnum):
+    UNITY_CATALOG = "UNITY_CATALOG"
+    SNOWFLAKE = "SNOWFLAKE"
+    BIGQUERY = "BIGQUERY"
+
+
+class SourceSchema(CommonBaseModel):
+    name: Optional[str] = Field(alias="name", default=None)
+    tables: Optional[List[str]] = Field(alias="tables", default=None)
+
+
+class CatalogItem(CommonBaseModel):
+    catalog: Optional[str] = Field(alias="catalog", default=None)
+    catalog_schema: Optional[str] = Field(alias="catalog_schema", default=None)
+    table: Optional[str] = Field(alias="table", default=None)
+
+
+class Source(CommonBaseModel):
+    name: Optional[str] = Field(alias="name", default=None)
+    schemas: Optional[List[SourceSchema]] = Field(alias="schemas", default=None)
+
+    def get_schema_list(self) -> List[str]:
+        if not self.schemas:
+            return None
+
+        return [s.name for s in self.schemas]
+
+
+class PermissionObject(CommonBaseModel):
+    id: Optional[str] = Field(alias="id", default=None)
+    type: Optional[IamType] = Field(alias="type", default=None)
+
+
+class Permission(CommonBaseModel):
+    name: Optional[str] = Field(alias="name", default=None)
+    state: Optional[str] = Field(alias="state", default=None)
+    objects: Optional[List[PermissionObject]] = Field(alias="objects", default=None)
+
+
+class Policy(CatalogItem):
+    permissions: Optional[List[Permission]] = Field(alias="permissions", default=None)
+
+
+class PolicyExport(CommonBaseModel):
+    source: Optional[Source] = Field(alias="source", default=None)
+    type: Optional[PolicyWeaverConnectorType] = Field(alias="type", default=None)
+    policies: Optional[List[Policy]] = Field(alias="policies", default=None)
+
+
+class FabricConfig(CommonBaseModel):
+    api_token: Optional[str] = Field(alias="api_token", default=None)
+    workspace_id: Optional[str] = Field(alias="workspace_id", default=None)
+    workspace_name: Optional[str] = Field(alias="workspace_name", default=None)
+    lakehouse_id: Optional[str] = Field(alias="lakehouse_id", default=None)
+    lakehouse_name: Optional[str] = Field(alias="lakehouse_name", default=None)
+
+
+class ServicePrincipalConfig(CommonBaseModel):
+    tenant_id: Optional[str] = Field(alias="tenant_id", default=None)
+    client_id: Optional[str] = Field(alias="client_id", default=None)
+    client_secret: Optional[str] = Field(alias="client_secret", default=None)
+
+
+class SourceMapItem(CatalogItem):
+    lakehouse_table_name: Optional[str] = Field(
+        alias="lakehouse_table_name", default=None
+    )
+
+
+class SourceMap(CommonBaseModel):
+    type: Optional[PolicyWeaverConnectorType] = Field(alias="type", default=None)
+    source: Optional[Source] = Field(alias="source", default=None)
+    fabric: Optional[FabricConfig] = Field(alias="fabric", default=None)
+    service_principal: Optional[ServicePrincipalConfig] = Field(
+        alias="service_principal", default=None
+    )
+    mapped_items: Optional[List[SourceMapItem]] = Field(
+        alias="mapped_items", default=None
+    )

policy_weaver-0.1.0/policyweaver/models/databricksmodel.py

@@ -0,0 +1,72 @@
+from policyweaver.models.common import (
+    CommonBaseModel, 
+    IamType,
+    SourceMap
+)
+from pydantic import Field
+from typing import Optional, List
+
+
+class Privilege(CommonBaseModel):
+    principal: Optional[str] = Field(alias="principal", default=None)
+    privileges: Optional[List[str]] = Field(alias="privileges", default=None)
+
+
+class BaseObject(CommonBaseModel):
+    id: Optional[str] = Field(alias="id", default=None)
+    name: Optional[str] = Field(alias="name", default=None)
+
+
+class PrivilegedObject(BaseObject):
+    privileges: Optional[List[Privilege]] = Field(alias="privileges", default=None)
+
+
+class FunctionMap(BaseObject):
+    columns: Optional[List[str]] = Field(alias="column", default=None)
+
+
+class Function(PrivilegedObject):
+    sql: Optional[str] = Field(alias="sql", default=None)
+
+
+class Table(PrivilegedObject):
+    column_masks: Optional[List[FunctionMap]] = Field(
+        alias="column_masks", default=None
+    )
+    row_filter: Optional[FunctionMap] = Field(alias="row_filter", default=None)
+
+
+class Schema(PrivilegedObject):
+    tables: Optional[List[Table]] = Field(alias="table", default=None)
+    mask_functions: Optional[List[Function]] = Field(
+        alias="mask_functions", default=None
+    )
+
+
+class Catalog(PrivilegedObject):
+    schemas: Optional[List[Schema]] = Field(alias="schemas", default=None)
+
+
+class WorkspaceUser(BaseObject):
+    email: Optional[str] = Field(alias="email", default=None)
+
+
+class WorkspaceGroupMember(BaseObject):
+    type: Optional[IamType] = Field(alias="type", default=None)
+
+
+class WorkspaceGroup(BaseObject):
+    members: Optional[List[WorkspaceGroupMember]] = Field(alias="members", default=None)
+
+
+class Workspace(BaseObject):
+    catalog: Optional[Catalog] = Field(alias="catalog", default=None)
+    users: Optional[List[WorkspaceUser]] = Field(alias="users", default=None)
+    groups: Optional[List[WorkspaceGroup]] = Field(alias="groups", default=None)
+
+class DatabricksWorkspace(CommonBaseModel):
+    workspace: Optional[Workspace] = Field(alias="workspace", default=None)
+    api_token: Optional[str] = Field(alias="api_token", default=None)
+
+class DatabricksSourceMap(SourceMap):
+    databricks: Optional[DatabricksWorkspace] = Field(alias="databricks", default=None)

policy_weaver-0.1.0/policyweaver/models/fabricmodel.py

@@ -0,0 +1,77 @@
+from policyweaver.models.common import CommonBaseModel, CommonBaseEnum
+from typing import List, Optional
+from pydantic import Field
+
+
+class FabricPolicyAccessType(str, CommonBaseEnum):
+    EXECUTE = "Execute"
+    EXPLORE = "Explore"
+    READ = "Read"
+    READ_ALL = "ReadAll"
+    RESHARE = "Reshare"
+    WRITE = "Write"
+
+
+class FabricMemberObjectType(str, CommonBaseEnum):
+    GROUP = "Group"
+    MANAGED_IDENTITY = "ManagedIdentity"
+    SERVICE_PRINCIPAL = "ServicePrincipal"
+    USER = "User"
+
+
+class PolicyEffectType(str, CommonBaseEnum):
+    PERMIT = "Permit"
+
+
+class PolicyAttributeType(str, CommonBaseEnum):
+    ACTION = "Action"
+    PATH = "Path"
+
+
+class EntraMember(CommonBaseModel):
+    object_id: Optional[str] = Field(alias="objectId", default=None)
+    object_type: Optional[FabricMemberObjectType] = Field(
+        alias="objectType", default=None
+    )
+    tenant_id: Optional[str] = Field(alias="tenantId", default=None)
+
+
+class PolicyMember(CommonBaseModel):
+    source_path: Optional[str] = Field(alias="sourcePath", default=None)
+    item_access: Optional[List[FabricPolicyAccessType]] = Field(
+        alias="itemAccess", default=None
+    )
+
+
+class PolicyMembers(CommonBaseModel):
+    fabric_members: Optional[List[PolicyMember]] = Field(
+        alias="fabricItemMembers", default=None
+    )
+    entra_members: Optional[List[EntraMember]] = Field(
+        alias="microsoftEntraMembers", default=None
+    )
+
+
+class PolicyPermissionScope(CommonBaseModel):
+    attribute_name: Optional[PolicyAttributeType] = Field(
+        alias="attributeName", default=None
+    )
+    attribute_value_included_in: Optional[List[str]] = Field(
+        alias="attributeValueIncludedIn", default=None
+    )
+
+
+class PolicyDecisionRule(CommonBaseModel):
+    effect: Optional[PolicyEffectType] = Field(alias="effect", default=None)
+    permission: Optional[List[PolicyPermissionScope]] = Field(
+        alias="permission", default=None
+    )
+
+
+class DataAccessPolicy(CommonBaseModel):
+    id: Optional[str] = Field(alias="id", default=None)
+    name: Optional[str] = Field(alias="name", default=None)
+    decision_rules: Optional[List[PolicyDecisionRule]] = Field(
+        alias="decisionRules", default=None
+    )
+    members: Optional[PolicyMembers] = Field(alias="members", default=None)