Repository navigation
docs(#2810): B2 grant via external_privileges_role; DEV+PROD live - #2849
Merged
Merged
Conversation
The container EXECUTE grant on the AI Core remote source belongs on the broker-created <schema>::external_privileges_role (SAP HDI's documented path for external-object access), NOT a specific _RT user and NOT default_access_role.hdbrole: - each CF binding mints a new _RT user, so a per-user grant breaks on rebind (and fails outright if the binding is gone: 'invalid user name'); - the role is auto-assigned to every binding user and persists for the life of the container; - default_access_role.hdbrole would REVOKE the container's default run-time-schema permissions as a side effect, and #OO can't grant EXECUTE on a remote source it doesn't own. Verified on DEV + PROD (2026-10-19): a container _RT user inheriting only ::external_privileges_role returned a 1536-dim text-embedding-3-small vector via TUTORIALS_AICORE. PROD section marked DONE.
This was referenced Oct 19, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Final doc correction for the HANA↔AI Core setup. The container's
EXECUTEgrant on the remote source belongs on the broker-created<schema>::external_privileges_role— SAP HDI's documented path for access to objects outside the container.Why this (and not the earlier attempts)
_RTuser: each CF binding mints a new_RTuser (PROD has 9), so a per-user grant breaks on rebind — and fails outright once a binding is gone (invalid user name, which is how the first PROD B2 attempt failed).default_access_role.hdbrole: that artifact revokes the container's default run-time-schema permissions as a side effect, and#OOcan't grantEXECUTEon a remote source it doesn't own.external_privileges_roleis auto-assigned to every binding user and persists for the life of the container → rebind-proof, no deploy, no grantor service.Verified on DEV + PROD (2026-10-19)
A container
_RTuser inheriting only::external_privileges_role(no direct grant) returned a 1536-dimtext-embedding-3-smallvector viaTUTORIALS_AICOREin both environments.Changes
external_privileges_rolegrant (DEV + PROD SQL), with explicit "do NOT grant to_RT" / "do NOT usedefault_access_role" guidance and a verify query.Issue #2810's basic-setup goal (connect AI Core to HANA, prove
VECTOR_EMBEDDINGfrom the DB layer) is now complete on both tiers in both environments. Moving existing Node/CAP embeddings into the DB is the separate follow-up unit.