A single GraphQL request moves through these stages:
Authenticate
The token resolver validates the request's token into a current user. The identity resolver then maps it to a resolved identity, including whether the caller is a service principal.
Authorize
Before the resolver runs, scope authorization checks the field's required scopes against the context. Those scopes are authenticated, read permission, and write permission.
Resolve credentials
The runtime's auth resolver produces request-scoped credentials for the target data source. It applies any impersonation resolver, per-source first, then global.
Build and run
The query builder builds the SQL from the GraphQL selection. The adapter renders it and executes it against the engine.
Transform and respond
LakeQL decodes the response, transforms it into typed records, and returns it with pagination metadata.
Errors #
Anything that fails along the way becomes a normalized error. The adapter throws a typed DataSourceError. The API maps it to a GraphQL error with a stable code and HTTP status, logs it server-side, and forwards it to the onError hook. See error handling.
Shutdown #
The runtime owns the data-source connections. When the process receives a shutdown signal, the application calls runtime.close() to release them. See the runtime lifecycle.