SQL Server – User Context for Table Trigger Execution

sql serversql-server-2008-r2trigger

I have a table that I am using Insert/Update/Delete triggers to audit. I want to restrict access to the audit table so that only the triggers can write to it. What I am trying to find out is, what user would those triggers count as for inserting records into the audit table.

EDIT: Since phil showed me the documentation in his comment for how it is determined, this changes my question a little.

What is a good method to restrict access to the audit table so that only the triggers can insert records?

Best Answer

There is no need to elevate permissions with EXECUTE AS with ownership chaining. To ensure rows are inserted into the audit table only via the trigger, simply don't grant INSERT permissions on the audit table. As long as all the objects are owned by the same user (e.g. dbo), the ownership chain will be unbroken and permit the trigger to insert into the audit tables without direct permissions.