App access

An app built on the API for GraphQL does not use your Krusgraph sign-in. It calls the API with its own identity, usually a Microsoft Entra service principal (the route app_starter drafts), and what it can read depends on two settings in Fabric:

• Who may call the API. The app's identity needs Run Queries and Mutations on the item (the second manual step above), and for a service principal the tenant setting that lets service principals use Fabric APIs.
• Which identity reads the data. The API connects to its source either with single sign-on, where each caller's own identity reads the source and that caller's permissions (row-level security defined on the source included) apply, or with saved credentials, where one stored identity reads the source for every caller. With saved credentials a caller needs only access to the API, so the app's users can see data they have no permission to read themselves. Krusgraph does not set this; check it in the item's settings in the Fabric portal before you publish an app.

The API for GraphQL has no row-level security of its own. Restrict rows at the source and use single sign-on, or expose only views that hold the rows the app may show. app_readiness lists what it can read about an API and marks the permissions as "unknown" with the portal path, because the Fabric API does not return them.