Comment by PunchyHamster

5 days ago

> Never let an agent hard-delete anything. Use soft deletes as a baseline for any table an agent can write to

How you even enforce it ?

And why you are even giving agent access to live DB in the first place ?

> How you even enforce it ?

  DENY DELETE TO [agent] ON DATABASE::current;

(yes, the recommended way would be to simply grant only SELECT,INSERT,UPDATE but if I were the DBA here I would definitely put in place an explicit deny)