permissions-hierarchy-database-engine.md

title	Permissions Hierarchy (Database Engine) | Microsoft Docs
ms.custom
ms.date	06/13/2017
ms.prod	sql-server-2014
ms.reviewer
ms.technology	security
ms.topic	conceptual
f1_keywords	sql12.swb.server.permissions.f1--May use common.permissions
helpviewer_keywords	security [SQL Server], denying access hierarchies [SQL Server], permissions securables [SQL Server] security [SQL Server], permissions permissions [SQL Server], hierarchy security [SQL Server], granting access
ms.assetid	f6d20a55-ef03-4e14-85f9-009902889866
author	VanMSFT
ms.author	vanto
manager	craigg

Permissions Hierarchy (Database Engine)

The [!INCLUDEssDE] manages a hierarchical collection of entities that can be secured with permissions. These entities are known as securables. The most prominent securables are servers and databases, but discrete permissions can be set at a much finer level. [!INCLUDEssNoVersion] regulates the actions of principals on securables by verifying that they have been granted appropriate permissions.

The following illustration shows the relationships among the [!INCLUDEssDE] permissions hierarchies.

Chart of SQL Server Permissions

For a poster sized chart of all [!INCLUDEssDE] permissions in pdf format, see https://go.microsoft.com/fwlink/?LinkId=229142.

Working with Permissions

Permissions can be manipulated with the familiar [!INCLUDEtsql] queries GRANT, DENY, and REVOKE. Information about permissions is visible in the sys.server_permissions and sys.database_permissions catalog views. There is also support for querying permissions information by using built-in functions.

See Also

Securing SQL Server Permissions (Database Engine) Securables Principals (Database Engine) GRANT (Transact-SQL) REVOKE (Transact-SQL) DENY (Transact-SQL) HAS_PERMS_BY_NAME (Transact-SQL) sys.fn_builtin_permissions (Transact-SQL) sys.server_permissions (Transact-SQL) sys.database_permissions (Transact-SQL)