For Platform and security leads who have to defend the setup to someone else
Data & AI governance
TechFabric designs Unity Catalog governance on Databricks: catalogue and schema structure, grants that match how teams are organised, lineage that survives change, and the permissions boundary for applications and agents running under their own service principal.
Unity Catalog designed so grants hold, lineage survives a refactor, and an agent inherits permissions instead of routing around them.
4 common questions, answered below ↓Governance gets bought after the first uncomfortable question, and by then the estate already exists. The work is deciding who can see what, proving it, and keeping lineage intact while data moves. On Databricks that means catalogue and schema design that matches how your teams are actually organised, grants that survive somebody leaving, and lineage that still resolves after a table is rebuilt. The part most teams have not thought about yet is agents: an agent with a service principal is a user, and if it reads through a path that bypasses your grants then your grants are decorative. Troy Busot draws that permissions boundary in the first conversation, because giving an agent reach into production data before the line exists is an incident with a date on it.
- Catalogue, schema and grant design that matches how your teams actually work
- Lineage that survives a refactor, so an audit question has an answer rather than a reconstruction
- Agents and applications running under their own service principal, inheriting your permissions
- Evaluation gates on promotion, so a failing check blocks a release instead of filing a ticket
How an engagement works
01
Talk to an engineer
A real conversation about your initiative with a senior engineer who has built this before. Not a sales call. What you are trying to build, what has been tried, and what is realistic.
02
Discovery and scoping
Two to three weeks to clarify requirements, evaluate where AI fits, and define realistic scope. On AI work this is also where success gets defined precisely enough to score, because a goal nobody can measure cannot be hillclimbed. You get a plan you can act on before committing to a larger engagement.
03
The right team, daily demos
We put the team the work actually needs on it and show you running software every day. Built with the same rigor as any enterprise system: tested, monitored, documented.
04
Production and beyond
Deployed and running under real load, handling real business processes. Ongoing support and team continuity for whatever comes next.
Migrations to Databricks
Off Snowflake, Synapse, Teradata and SQL Server, onto Lakehouse and Lakebase, with a cutover you can reverse.
Data engineering
Pipelines that hold, tables people trust, and a bill that stops surprising you.
Data science & AI
Context stores, memory, retrieval and governed agents that survive production.
Forward-deployed teams
Product, design and engineering people who sit inside your business, find the real problem, and ship it.
Product development
Full product delivery: multi-tenant architecture, operator consoles and the data layer under them. Shipped as Databricks Apps when the product belongs next to the lakehouse.
APIs & durable systems
Long-running operations that survive restarts and partial failure. Temporal under the lakehouse jobs, agent runs and approvals that must not half-complete.
FAQ
Data & AI governance, answered
We already have Unity Catalog turned on. Is that governance?
It is the substrate, not the answer. Turning it on gives you somewhere to express grants; it does not decide who should have them, whether lineage still resolves after a rebuild, or what an agent is allowed to touch. Most of the engagements we take start from a working Unity Catalog and an estate nobody can defend in a meeting.
How do you govern an AI agent?
The same way you govern a person, which is the point most teams miss. The agent runs under its own service principal and inherits Unity Catalog permissions rather than being handed a broad token. What it may do is a policy decision made before it is built, not a setting adjusted after something goes wrong. Fabric Tower at /accelerators/fabric-tower is what we use when a squad of agents needs watching rather than one.
Does this slow delivery down?
Retrofitting it does. Designing it alongside the pipeline does not, and it is considerably cheaper than the alternative, which is discovering during a security review that the grants do not hold. We put the permissions boundary in the first architecture conversation for exactly that reason.
Can you help us pass an audit we already have scheduled?
The first thing we establish is what is actually true: which grants exist, where lineage breaks, and what an examiner would find today. That inventory is quick, and it tells you what is reachable before the date rather than after it.