Direct Lake on SQL Endpoint + OneLake Security: Delegated vs. User Identity Mode (A Field Guide)

Direct Lake on SQL Endpoint + OneLake Security: the field guide. Model owned by an SPN, report published, refresh green — but every visual fails with QueryUserError? The reason is which identity actually reads the data , and it's not the one you think. Delegated vs. User identity mode, shortcut + native tables, SPN refresh traps, and the new Fabric default — decoded with diagrams and permission matrices. Save yourself the debugging session.