Databases
SQL Server
Reads catalog metadata, procedure bodies and write activity — the definitions git never sees.
SQL Server is the richest single source in most estates Decim is built for, because it holds definitions that exist nowhere else. A stored procedure altered in production has no commit; a SQL Agent job step is a row in a table; a table that quietly started taking writes last March appears in no diagram. All three are readable from catalog views.
Everything here is metadata rather than data. The permissions needed to build a complete
topology are VIEW DEFINITION and VIEW DATABASE STATE — no access to
rows in your fact tables at all. Row access is requested separately and only for the specific
reconciliation tables you name.
What Decim reads from SQL Server
Every item below is read-only, and each is a specific view, endpoint or file rather than a category of access. If something here is unacceptable in your environment, it can be removed from the query catalogue — see the agent for how that works.
| What | From | Why it matters |
|---|---|---|
| Object definitions | sys.sql_modules | Stored procedure and view bodies — often the only copy |
| Object change times | sys.objects.modify_date | Tests schema-change hypotheses in one query |
| Column metadata | sys.columns, sys.types | Type and nullability, for truncation and overflow causes |
| Dependency edges | sys.dm_sql_referenced_entities | is_updated separates a write from a read — this is how edge direction is derived |
| Write activity | sys.dm_db_index_usage_stats | Which tables are genuinely being written to, and when last |
| Live contention | sys.dm_exec_requests | Blocking and waits during a stall, if run while it is happening |
| Foreign keys | sys.foreign_keys | Structural edges between targets |
Permissions required
Written out in full, because "read-only access" is not a specification. Nothing below grants the ability to write, and row access is requested only on the specific tables you name.
CREATE LOGIN decim_agent WITH PASSWORD = '...';
CREATE USER decim_agent FOR LOGIN decim_agent;
-- Metadata only. No rows from user tables.
GRANT VIEW DEFINITION TO decim_agent;
GRANT VIEW DATABASE STATE TO decim_agent;
-- Reconciliation tables, named explicitly — never wildcarded.
GRANT SELECT ON dbo.IntakeBatch TO decim_agent;
GRANT SELECT ON dbo.RejectedTransactions TO decim_agent;
-- Fact tables at COLUMN scope: enough to count rows per batch,
-- structurally unable to read an amount or a customer identifier.
GRANT SELECT ON dbo.[Transaction](BatchId, LoadedAtUtc) TO decim_agent;
DENY ALTER, DELETE, INSERT, UPDATE, EXECUTE TO decim_agent;What it builds
What this source contributes to the pipeline topology and to the evidence available during an investigation:
- Transform nodes from stored procedure bodies, with read/write edge direction
- Target and store nodes from write activity, including undocumented ones
- Structural edges from foreign keys
- Schema change history sufficient to refute or confirm truncation causes
Nodes learned from a definition are marked declared; nodes observed running are marked observed; nodes both declared and observed are verified. Where two sources disagree, the disagreement is recorded as a drift note rather than resolved silently.
Failure modes it surfaces
What this source is uniquely good at proving — and, just as usefully, at disproving. An investigation that can refute a hypothesis cheaply is worth as much as one that confirms it.
| Failure mode | The signal |
|---|---|
| Silent schema change | modify_date inside the incident window |
| Undocumented reject table | Write activity on an object in no definition |
| Contention with another workload | Blocking sessions and waits during the stall |
| Truncation on insert | Column max_length against the values being written |
Limits
What this integration cannot tell you. Stated because an investigation that overstates its sources produces confident wrong answers, which is worse than an honest blocked.
- Live contention queries only show requests executing at that moment — they must run during the stall, not after
- Query Store gives far better historical plan and duration data, but is off by default on older instances
- Cross-server topology needs a login on each instance; linked-server hops are not followed automatically
Related integrations
- SQL Server Agent — Job steps are rows in msdb, not files in git. Reads sysjobs, sysjobsteps and sysjobhistory.
- SSIS — SSISDB holds executions, per-component row counts and the parameter values actually used.
- PostgreSQL — pg_stat_user_tables for write activity, pg_proc for function bodies, pg_stat_activity for live blocking.
See all integrations, or how the sources are combined into one graph.
Get started
Investigating a SQL Server pipeline?
Bring an incident you already know the answer to. If Decim gets it wrong, that is a more useful demo than one where it doesn't.