# Security and permissions

## Deployment model

**Single-tenant per customer** — each buyer hosts their own SovereignRepository. Multi-tenant shared hosting is not supported in v2.0.

## What Sovereign accesses

| Component | Target | Purpose |
|-----------|--------|---------|
| Repository DB | SovereignRepository on customer SQL | Catalog, telemetry, license, policy |
| Collector | Registered SQL instances | DMVs, backup/HADR/patch facts |
| API | localhost:3041 (configurable) | Console + ingest |

## Required permissions

### Repository (see `src/database/grants-repository-app.sql`)

- Dedicated role `dbaops_sovereign_app` — DML on app schemas, not sysadmin
- API service account mapped to that role

### Collector targets (see `src/database/grants-collector-target.sql`)

- `VIEW SERVER STATE`, `VIEW ANY DEFINITION`, `CONNECT SQL`
- No sysadmin, no ddl_admin

## Credentials

- **v28 catalog**: `ctl.CredentialReference` stores refs only
- Runtime resolution: env vars (`SOVEREIGN_CRED_<REF>_USER/PASSWORD`) or Windows Credential Manager
- **No plaintext passwords in SQL**

## Transport

- SQL: set `SOVEREIGN_SQL_ENCRYPT=true` for production; `SOVEREIGN_SQL_TRUST_SERVER_CERT=false` when using CA-signed certs
- Lab/self-signed: leave encrypt off (default) or set `SOVEREIGN_SQL_TRUST_SERVER_CERT=true` with encrypt on

## Licensing

- Signed `.license` file (Ed25519)
- Instance cap enforced via `ctl.LicenseEntitlements` + API gate
