An endorsement is a trust signal applied to a resource to indicate how much confidence the organisation places in it. In Fabric, endorsements help distinguish promoted or certified assets, but they are not a substitute for access control, sensitivity labeling, or review of how AI Skills use the resource.
What an endorsement is in security governance
An endorsement is a trust marker, not a control. It communicates that a team has judged a resource to be promoted, certified, or otherwise reliable enough for a stated use, but the endorsement itself does not enforce who can access it, what data it contains, or how it may be used.
That distinction matters because teams sometimes treat endorsement as if it were a substitute for access policy or review. It is better understood as metadata about confidence and provenance, useful for navigation and decision-making, but not a protection mechanism on its own.
How endorsements are used in a platform like Fabric
In platforms such as Fabric, endorsements help distinguish assets that have been formally promoted from those that are simply available. This can improve discoverability and help users select the right dataset, model, or shared resource without assuming that everything published has the same level of organisational confidence.
Used well, endorsement reduces ambiguity. It signals which resources have been reviewed, preferred, or certified by the organisation, which is especially valuable in environments where many assets are created quickly and not all are equally governed.
What an endorsement does not do
An endorsement does not grant access, remove sensitivity, or validate every downstream use of the resource. A highly endorsed asset may still contain restricted data, require separate approval, or need stronger handling because of the way it is consumed by applications, automations, or AI Skills.
That is why endorsement should be read alongside classification, permissions, and usage controls. If those mechanisms are absent, a trusted-looking resource can still be overexposed or misused.
Why endorsement matters for trust and adoption
Endorsement helps an organisation steer users toward assets it considers dependable. That can improve reuse, reduce duplication, and support better governance because teams are more likely to consume a clearly signposted resource than an unvetted one.
It also creates an expectation problem: once a resource is endorsed, users may assume it is safe for broader use than is actually permitted. The trust signal therefore needs clear meaning, consistent criteria, and an explicit boundary around what the endorsement covers.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | CM-8 — System Component Inventory | Endorsements depend on knowing which resources exist and are approved for use. |
| Recommendation — Inventory endorsed resources so teams can distinguish governed assets from unmanaged ones. | ||
| NIST CSF 2.0 | GV.OC-01 — Organizational Context | Endorsement reflects organisational confidence and approved use within governance context. |
| PR.AA-01 — Identity and Access Control | Endorsement is separate from access decisions, which still require enforced authorization. | |
| Recommendation — Define what endorsement means in your governance model and who can assign it. Keep access decisions separate from endorsement and enforce authorization independently. | ||
| ISO/IEC 27001:2022 | A.5.12 — Classification of information | Endorsement must sit alongside information classification rather than replace it. |
| Recommendation — Align endorsement with classification so trust signals do not override handling rules. | ||
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 1, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org