Databases & Accounts

This section clarifies how VaultSQL models access so teams can stay organized and secure without extra complexity.

Databases

A database in VaultSQL represents a real database server you want the team to access. Each database can have one or more accounts attached to it.

Accounts (Credentials + Access Intent)

An account is a set of credentials tied to a database. It’s how VaultSQL maps a user’s intent (read-only vs admin) to the actual permissions enforced by the database.

Key points:

• Accounts are meant to reflect clear access boundaries (e.g., “Read‑Only”, “Admin”, “Analyst”).
• VaultSQL adds guardrails and prompts, but the database is the source of truth for permissions.
• For best results, configure permissions directly on the database (e.g., a read‑only user that cannot write).

Recommended Access Model

• Create least‑privilege accounts in the database (read‑only for analytics, separate admin for changes).
• Attach those credentials as accounts in VaultSQL with clear names.
• Grant users access to the right account based on their role.

This approach keeps access consistent and predictable, and lets your database do what it’s designed to do: enforce permissions reliably.