IF NOT EXISTS on roles

ACCESS privilege granted

MATCH privilege for analysts

DENY on PII fields

DENY overrides GRANT approach

Write role privileges

Role assignment

Verification via SHOW ROLE PRIVILEGES AS COMMANDS

SHOW USER PRIVILEGES verification

System database context noted

No inline plaintext passwords

Design decision documented

FOR pattern used

GRANT TRAVERSE for navigation

FOR pattern read-only constraint noted

Write restriction prevents classification change

IF NOT EXISTS guards

ACCESS privilege on database

Cleared analyst full read

Performance overhead mentioned

Verification commands included

Privilege escalation limitation noted

Parameterized passwords

CHANGE REQUIRED on new users

IF NOT EXISTS on CREATE USER

Bulk GRANT ROLE

Suspend instead of drop

IF EXISTS on ALTER USER

SHOW USERS audit query

SHOW USERS filtered

Plan documented before execution

System database context

engineer role setup

Impact annotations in plan