ERP Database Read-Only Access Request Form
Analysts need to query the ERP database, and administrators need to know who can see what. This form records a narrow, expiring, read-only grant instead of an open-ended db_datareader on production.
Fill in
ERP Database Read-Only Access Request Form
Read-Only Database Access Request
Applicant: Mei Lin Tan Role: Finance systems analyst Line manager: Rahul Verma
Access requested
Database: ERP_PROD on SQL01 (use a reporting replica if available) Scope: Named views only Authentication: Windows or SSO group Start: 2026-11-01 Expiry: 2027-01-31
Objects needed: Views for sales invoices, purchase receipts and item master. No payroll, HR or banking tables.
Purpose
Month end reconciliation of receipts to GL and ad hoc margin analysis.
Conditions
| Condition | Acknowledged |
|---|---|
| Access is read only, no INSERT, UPDATE, DELETE or DDL | |
| Long running or unfiltered queries on production are not permitted | |
| Extracts containing sensitive data are stored only in approved locations | |
| Credentials are not shared | |
| Access is reviewed at expiry and removed if not renewed |
Approvals
Adapt to your own access control and segregation of duties policy. Where possible grant access through a group, to views, on a reporting replica. This is a starting template, not legal advice.
Safer ERP data access
Optional: a conversation about giving analysts governed answers from ERP data without broad database logins.
Optional. The tool and every export work without this. No spam.
How to use the form
Pick the narrowest scope that does the job. Named views beat named tables, and named tables beat the whole schema. Say what the person will do with the data, because the purpose decides which objects and which environment are appropriate. Set an expiry date even for ongoing roles, so access is reviewed rather than forgotten.
Least privilege in practice
Read-only access still carries risk. A wide SELECT can lock or slow a busy ERP, expose cost and personal data, and move data outside the company. Prefer a reporting replica, a read-committed snapshot or a data warehouse copy for analysts. Grant through an Active Directory or SSO group so that offboarding removes access automatically.
- Views that hide sensitive columns
- A replica or snapshot instead of production
- Group based grants, not individual logins
- Expiry and periodic recertification
What the DBA should check
The DBA confirms the object list exists, that the grant is SELECT only, that row level or column level restrictions are in place where needed, and that query governor or resource limits protect the production workload. The form gives them a record to attach to the change ticket and to produce for auditors.
Common mistakes
Frequent errors are granting sysadmin or db_owner to save time, reusing a shared reporting login, leaving access active after a role change, and approving access without stating which tables hold personal, payroll or export controlled data. A short form and a fixed expiry fix most of these.
Frequently Asked Questions
Is read-only access safe on a production ERP?
It is safer than write access but not free of risk. Unfiltered queries can cause locking or heavy load, and the data may be sensitive. Use a replica or snapshot and resource limits where you can.
Should I grant access to tables or views?
Views are usually better. They hide sensitive columns, survive table changes and give you one place to apply filters such as company or plant. Direct table access is a fallback.
How long should access last?
Match it to the business need. Project work often fits 90 days. Ongoing roles can be 12 months with recertification. The point is that expiry forces a conscious review.
Who must approve?
At minimum the line manager and the data owner, then the DBA for technical execution. Add information security for sensitive data or external users such as contractors.
If you want people to ask questions of ERP data without handing out database logins, we can help you set up read-only, role-aware access that shows the underlying query and stays inside your network.
Related Tools
ERP Data Request Form Template
A fill-in form that turns a vague 'can you pull me a report' email into a complete, approvable ERP data request.
ERP OperationsERP Production Data Fix Request Template
A change record for direct data corrections: what is wrong, the exact script, the backup, the rollback and who approved it.
Developer ToolsERP Data Dictionary Worksheet
An editable table to document ERP tables and columns with type, length, null rate, fill rate and owner.
Developer ToolsScheduled SQL Job Register Worksheet
An editable register of scheduled jobs with daily runtime, dependencies, owners and failure contacts.