Blog

The SQL Server Security Model: Logins, Users, Schemas, Roles, Least Privilege and Row-Level Security

Making the application user db_owner hands out table-dropping rights in an injection hole; the right way is to separate runtime and migration identities, grant through schemas and roles, and protect critical rows with Row-Level Security. SQL Server 2025's PBKDF2 password hashes, DENY precedence, RLS with SESSION_CONTEXT and how the predicate shape affects performance, why DDM isn't a security boundary, and connection tests with TrustServerCertificate and TDS 8.0 strict.