How SQL Server stored procedures use EXECUTE AS and ownership chains to grant table access

·2 views

The article explains that stored procedures can let callers reach tables without direct table permissions, with the effective authority determined by module execution context and ownership chains. It describes how SQL Server skips a second permission check when a module and its referenced objects share an owner, and outlines the EXECUTE AS options of CALLER, SELF, OWNER, or a named principal. It warns that a procedure owned by a highly privileged account can become a broad access path, so reviews should focus on the code and module identity. Recommended practices include inventorying modules with non-caller contexts, scrutinizing dynamic SQL and cross-database calls, auditing ownership and impersonation changes, and testing with low-privilege accounts. The author concludes that these tools reduce direct grants but become risky when the delegated identity exceeds what the task requires.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

APIOps for Azure API Management: Extracting, Reviewing and Publishing with the CLI

Portal edits to an Azure API Management instance can be silently overwritten when Bicep redeploys the same policy, leaving no record of the change. The article proposes APIOps, which stores APIs, policies and products as files that can be reviewed through pull requests. Ownership is split so Bicep manages the platform while APIOps manages the API surface, controlled by a new apiSurfaceOwner parameter that defaults to bicep. The sample uses the APIOps CLI version 1.0.5, extracting live resources with a filter and running GitHub Actions workflows for nightly extraction and approved publishing. The author notes that nothing was deployed, and that behaviour on a live instance is described only where stated.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Calibration-free top-k selector speeds MoE decoding without threshold tuning

A new top-k channel selector for Mixture-of-Experts models removes the need for offline score-threshold calibration while keeping accuracy and latency gains. Previously, thresholds fitted on held-out data were used to limit routed-expert reads, but this varied across inputs and could trigger repetition loops in models such as Gemma-4. The approach instead keeps each token's k highest-scoring channels, requiring no calibration data. In reported comparisons it matched or beat the threshold version in 40 of 43 cases at 13% and 18% budgets. The authors report retaining 98.1% of full-model accuracy at 17.8% of routed-expert reads on three post-trained MoE models, with Triton kernels running MoE blocks 1.60 to 1.90 times faster than optimized vLLM at batch size one. The evaluation is limited to those three checkpoints and Triton kernels, so generalization to other model families and hardware remains unconfirmed.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Two Models for AI-Powered BI: Dashboards with Agents vs. Agent-First Design

The author argues that the right AI-driven business intelligence design depends on data scope, user count, and how predictable questions are. For a narrow procurement project called SpendCube, built on Azure Databricks, Azure SQL Database, and Power BI, a dashboard paired with an AI agent is presented as practical. Power BI Copilot is cited as an example, with the key requirement being that the agent use the existing semantic model so its answers match dashboard KPIs. In contrast, BMW's Mobile Data Recorder collects over 10,000 signals from roughly 3,500 vehicles, making it impossible to anticipate every engineering question in advance. For such large, unpredictable datasets, the author favors an agent-first approach in which engineers describe what they want to investigate and the agent generates queries and visualizations.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Support FAQ bot invented 22 answers until grounding cut that to zero

A tester evaluated a small n8n support-FAQ workflow using a 1.8B-parameter model running locally, asking 20 questions across two prompt versions over 120 runs. The model answered all 30 known questions correctly but gave answers to 29 of 30 unanswerable questions, and 22 of those asserted facts absent from the knowledge base, such as denying a phone number or Slack integration. Prompt wording alone did not stop the fabrication, so the author required the model to cite a knowledge-base entry and a supporting quote. A Code node then verifies that evidence and falls back to a handover message when it is missing. The approach aims to reduce fabricated answers that could mislead customers into not buying.

0 comments Read more at DEV Community