# Database roles: separate queries, maintenance and recovery

https://thiago.limaesilvatecnologia.com.br/en/artigos/database-roles/

Published: 2026-09-12

A shared credential hides distinct operational decisions.

Content produced with AI assistance for Thiago Silva’s website. Independent editorial analysis; it does not represent clients or employers.

Reading-path month: February 2026

Collection published on September 12, 2026. Months organize the reading path; they are not earlier publication dates.

A short architecture article. The technical reference supports the topic; hypothetical scenarios and assessment proposals are editorial analysis, not accounts of personal implementations.

## The architecture decision

An application queries data daily; restoration is rare. Sharing one identity between these activities simplifies configuration but makes access harder to limit and explain.

## Practical application

Editorial proposal: inventory operations by purpose before granting permissions. In a hypothetical service, distinguish transactional reads, schema migration and recovery. Support needs a defined access path without extracting application credentials.

## How to verify

Review one maintenance task in testing and record the permissions it actually needs. Then confirm the everyday identity cannot perform it. This makes operational exceptions explicit and reduces the reach of an application problem.

## Sources

- [OWASP — Database Security Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Database_Security_Cheat_Sheet.html). Accessed: 2026-09-12.

[Profile: Thiago Silva | Cyber Architect](https://thiago.limaesilvatecnologia.com.br/en/perfil/)