SQL Permissions and Access Review for a Reporting Database (Defensive)
Check accounts and grants for least privilege.
The Open buttons send the prompt text as currently shown below to that site only when you click. Fill in the placeholders first.
[VERIFY] is an editorial flag, not a blank to fill. Wherever the prompt shows [VERIFY], check that item against a reliable source before you use it.
Review database access as a defensive review of my own database. Users, roles and their grants (tables, schemas, privileges): [GRANTS]. Applications and service accounts that connect: [SERVICE_ACCOUNTS]. Sensitive tables or columns: [SENSITIVE_DATA]. Our policy: [POLICY]. Begin with a table of accounts and the highest privilege each holds, then group findings: excessive rights, shared or orphaned accounts, access to sensitive columns without need, write access for reporting users, accounts of leavers, passwords that never expire where policy says otherwise, and service accounts with broad rights. Rate each by risk and effort. Propose a role model as a table with Role, Typical members, Can do and Cannot do: reporting_reader (analysts: select on the reporting schema), analyst_plus (select on selected raw tables with masked sensitive columns [VERIFY]), etl_service (insert and update on staging only), admin (a restricted number, all rights, activity logged). Explain how to test a change: a test account for each role running a standard set of queries that should succeed or fail. Migration plan: create the roles, add users, test with sample queries, remove direct grants, with changes that can be tested and reversed and a list of people to consult before removing access. Add a joiner, mover and leaver checklist, a message to application owners, a quarterly review, and a list of sensitive columns with the treatment of each. Never ask me to paste passwords or connection strings; mark grant syntax [VERIFY].
Fill in before use
Optional: type your details and the prompt above updates. Nothing is saved or sent.
Replace each bracketed placeholder with your own details, then paste into Any AI or another assistant.