[BUG] TEST: Help Wanted — Incorrect tenant-level Fabric Administrator requirement for workspace fab acl ls (upstream #97)

[ayeshurun]

📋 Copied from microsoft/fabric-cli#97 for AI triage testing.
Expected triage outcome: Help Wanted

---

Question

In the documentation it states that fab acl ls requires the Fabric Administrator role:
https://github.com/microsoft/fabric-cli/blob/fd4f054c430f651444662aed380536f521658334/docs/commands/acls/index.md?plain=1#L22-L32

When checking the code, to me it does not seem to use any Admin APIs? For example the workspace acl ls:
https://github.com/microsoft/fabric-cli/blob/fd4f054c430f651444662aed380536f521658334/src/fabric_cli/client/fab_api_workspace.py#L76-L81

Context

I have tested the fab acl ls with a user that only has workspace admin privileges (not Fabric Admin privileges) and the command succeeds just fine (even the fab cli states it requires Fabric Admin role).

$ fab acl ls DEMO Fabric CICD-feat-cleanup-workspace-after-branch-deletion.Workspace
! Requires Fabric admin role
acl     identity                               type
------------------------------------------------------------------
Admin   XXXXXXXXXXXXXXXXXXXXXX                 Group
Admin   XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX   User
Admin   XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX   ServicePrincipal

fabric-cli version (if relevant)

1.3.1

Operating System (if relevant)

Not applicable

CLI Mode (if relevant)

Not applicable

Have you checked the documentation?

• I have searched existing GitHub issues
• I have reviewed the fabric-cli documentation

Additional Information

No response

[github-actions]

🅰️ Approach A (Action) — prompt-only, no codebase access

AI Assessment: Potential Bug

Analysis
The report highlights a discrepancy between the documentation and observed behavior. The documentation specifies that fab acl ls requires the Fabric Administrator role, yet users with only workspace admin privileges can successfully execute the command. The referenced code does not appear to enforce Fabric-level admin permissions, suggesting that either the documentation is incorrect or the CLI insufficiently validates required permissions.

This mismatch may cause confusion for users, undermining expected security boundaries. It is important to confirm whether the documentation or the implementation is correct and ensure both are aligned, especially since access control logic impacts security and user guidance.

Next Steps
🔔 Escalated to team — This issue requires team review and has been flagged for attention.

---

💡 If this issue requires the team's attention and was not escalated, you can tag @microsoft/fabric-cli-dev to notify the team.

---

🏷️ Label Decisions (testing mode — not applied)

Decision	Value
AI assessment	ai:bug-triage:potential bug
Would add help wanted	❌
Would add ai:needs team attention	✅
Would request author feedback	❌
Would remove needs triage	❌
Would auto-close	❌
Would notify team	✅

[github-actions]

🅱️ Approach B (Code Agent) — code-aware triage agent that reads the actual source code

AI Assessment: Potential Bug

The report correctly highlights a discrepancy between the official documentation and observed CLI behavior for fab acl ls on workspaces. While the documentation states Fabric Administrator permissions are required, the code (src/fabric_cli/commands/acls/fab_acls_ls.py) calls standard workspace ACL APIs, and the user confirms that workspace admin users can execute the command successfully.

No privileged or tenant-level API endpoints are being invoked in the relevant code paths (see api_workspaces.acl_list_from_workspace). Per RFC 7231 and Microsoft REST API Guidelines, the underlying API is expected to return a 403 if insufficient privileges, but the reported CLI and API behavior allow workspace admins to see workspace ACLs. The CLI's warning message (! Requires Fabric admin role) is therefore misleading and does not reflect actual access requirements or API usage.

If the documentation is inaccurate, this could confuse users about required permissions, leading to unnecessary escalations or support overhead. No security or data-loss risk arises, but clarity on privilege requirements is important for usability.

Next Steps:
🔔 Escalated to team — This issue requires team review and has been flagged for attention.

---

💡 If this issue requires the team's attention and was not escalated, you can tag @microsoft/fabric-cli-dev to notify the team.

---

🏷️ Label Decisions (testing mode — not applied)

Decision	Value
AI assessment	Potential Bug
Would add help wanted	❌
Would add ai:needs team attention	✅
Would request author feedback	❌
Would remove needs triage	❌
Would auto-close	❌
Would notify team	✅