Chapter 23 · SQL Server 2025 Features: Vector Data, AI-Oriented Workloads, and Modern Development
Security, Governance, Observability, and Cost Controls for AI-Adjacent Database Workloads
Threat-model vectors, source text, inference endpoints, credentials, telemetry, retention, egress, and cost as one governed AI-adjacent data system.
Learning outcomes
An embedding can reveal more than its raw floating-point values suggest. A vector generated from sensitive text may preserve semantic relationships that enable membership or similarity inference. An external model call can send source data beyond the database boundary. SQL Server permissions protect objects, but they cannot decide whether a model provider may legally receive a customer's transcript or whether a token bill is acceptable. AI-adjacent database work therefore needs security, privacy, egress, telemetry and cost controls as one operating model.
Threat-model source text, embeddings, external model endpoints, credentials and query/result telemetry as separate assets.
Apply least privilege to vector tables, external models and REST invocation rather than using broad database ownership.
Design outbound-network and credential controls that prevent accidental data exfiltration.
Capture latency, failures, model/version, row counts and cost proxies without logging secrets or sensitive payloads.
Define retention, deletion and re-embedding obligations for derived vectors when source data changes or must be removed.
ServiceHubAILab. They use deterministic mock
vectors, so no paid model API, API key, cloud account, or
outbound network access is required. No external call is made.
The governance lab stores only synthetic ServiceHub
classifications and request accounting. Preview features remain
disabled.
1. Classify raw text and vectors independently
Embeddings are derived data. They may be harder for a human to read than the source text, but “not readable” is not the same as “not sensitive.” If source text contains personal, contractual or security information, assume the embedding and nearest-neighbor outputs deserve a matching classification until your privacy/security analysis proves otherwise.
USE ServiceHubAILab;GOIF OBJECT_ID(N'lab23.AIAssetPolicy', N'U') IS NULLBEGIN CREATE TABLE lab23.AIAssetPolicy ( asset_name nvarchar(100) PRIMARY KEY, classification varchar(20) NOT NULL, outbound_allowed bit NOT NULL, retention_days int NULL, owner_role sysname NOT NULL, policy_note nvarchar(500) NOT NULL );END;DELETE lab23.AIAssetPolicy;INSERT lab23.AIAssetPolicy(asset_name,classification,outbound_allowed,retention_days,owner_role,policy_note) VALUES (N'KnowledgeItem.source_text','confidential',0,365,N'db_data_steward',N'Do not send outside approved boundary.'), (N'KnowledgeItem.embedding','confidential',0,365,N'db_ai_reader',N'Derived semantic representation; protect like source.'), (N'approved_embedding_endpoint','restricted',1,NULL,N'db_ai_operator',N'Endpoint metadata only; secret stays in credential store.');This table is not a security boundary by itself; it is governance evidence. Enforcement still uses database permissions, network controls, identity, approved endpoints and application policy.
2. Least privilege for AI operations
Creating external models or credentials is administrative. Using
a specific external model should be narrower. SQL Server 2025
supports EXECUTE permission on an external model;
REST invocation uses the database permission
EXECUTE ANY EXTERNAL ENDPOINT. Avoid granting broad
CONTROL DATABASE merely because one service needs
embeddings.
USE ServiceHubAILab;GOSELECT name, USER_NAME(principal_id) AS owner_name, model_type_desc, location, modelFROM sys.external_models;SELECT HAS_PERMS_BY_NAME(DB_NAME(), 'DATABASE', 'EXECUTE ANY EXTERNAL ENDPOINT') AS can_call_external_endpoints, HAS_PERMS_BY_NAME(DB_NAME(), 'DATABASE', 'ALTER ANY EXTERNAL MODEL') AS can_administer_external_models;Metadata visibility itself follows SQL Server security. Monitoring principals should be able to see operational state without automatically gaining permission to alter model or credential objects.
3. Outbound egress is part of database security
Once SQL Server can call HTTPS endpoints, firewall/DNS/proxy allowlists and credential URL matching become part of the data boundary. The remote endpoint sees data SQL Server sends. TLS protects the connection in transit but does not answer whether the destination is approved, what it logs, where it processes data, or how long it retains the request.
USE ServiceHubAILab;GOIF OBJECT_ID(N'lab23.AIRequestAudit', N'U') IS NULLBEGIN CREATE TABLE lab23.AIRequestAudit ( request_id bigint IDENTITY PRIMARY KEY, occurred_at datetime2(3) NOT NULL CONSTRAINT DF_lab23_AIRequestAudit_time DEFAULT SYSUTCDATETIME(), operation varchar(30) NOT NULL, model_name sysname NULL, source_row_count int NOT NULL, input_characters bigint NULL, elapsed_ms int NULL, outcome varchar(20) NOT NULL, error_number int NULL, correlation_id uniqueidentifier NOT NULL );END;INSERT lab23.AIRequestAudit(operation,model_name,source_row_count,input_characters,elapsed_ms,outcome,error_number,correlation_id)VALUES ('mock-embedding',N'lab-mock-v1',8,350,12,'success',NULL,NEWID());SELECT TOP (20) * FROM lab23.AIRequestAudit ORDER BY request_id DESC;Notice what is not logged: API keys, source text, embedding arrays and complete endpoint payloads. A separate secure diagnostic path can capture sensitive detail under incident authorization if required.
4. Retention and deletion must include derived data
If a user's source content must be deleted, keeping the vector forever can violate the intended deletion semantics. Track lineage from source row/chunk to embedding so a delete/reclassification can remove or regenerate derived data. If model output changes, keep versioned evidence long enough to support rollback and incident analysis, then retire it intentionally.
USE ServiceHubAILab;GOSELECT item_id, embedding_model, embedding_dimensions, embedded_at, CASE WHEN embedding_model <> N'lab-mock-v1' THEN 'MODEL_MISMATCH' WHEN embedding_dimensions <> VECTORPROPERTY(embedding,'Dimensions') THEN 'DIMENSION_METADATA_MISMATCH' WHEN content_hash <> HASHBYTES('SHA2_256', source_text) THEN 'SOURCE_CHANGED' ELSE 'CURRENT' END AS embedding_stateFROM lab23.KnowledgeItemORDER BY item_id;This check turns “is the vector current?” into data evidence. Production systems can queue stale rows for bounded re-embedding rather than silently serving mixed state.
5. Cost is also an operational control
External model cost may depend on characters/tokens, calls, model tier and provider policy. Database resource cost includes CPU for exact vector scans, memory/storage for vectors/indexes, Query Store/XEvent telemetry and transaction impact. Budget with measurable units: rows embedded per hour, average source length, retry rate, endpoint latency, exact-scan candidate count, preview index build time and vector storage growth. Do not publish a fake universal “cost per million vectors.”
Check your understanding
- Are embeddings automatically non-sensitive because humans cannot read them directly?
- What permission allows REST endpoint execution from a database?
- Why avoid logging full prompts/source text in ordinary telemetry?
- What should happen when source content changes?
- What should AI cost telemetry record?
Review the answers
1. No. Treat them as derived potentially sensitive data and classify them according to source/use risk.
2.
EXECUTE ANY EXTERNAL ENDPOINT.
3. Telemetry becomes another sensitive-data store and can leak information to operators, monitoring systems or support workflows.
4. Detect the lineage/hash change and re-embed or invalidate the derived vector under a controlled migration.
5. Work units such as calls, input size, retries, latency, row counts and model identity—not secrets or raw sensitive payloads.