[petriw]

Just remember to always verify it's still read only.

Or a coworker will find the login in your scripts, repurpose it, then notice they need more rights and "fix" the account for you.

[MBCook]

Plus read-only isn't a guarantee. You can't write data, but you can run a bad select or join that ends up effectively locking the database.

SELECT * FROM my_200_GB_table will always be there.

[michaelt]

Why should a select or join lock a database? Surely no database lets one query starve another of IO or CPU?

[mst]

I like to suffix such account names with _readonly.

[arethuza]

"find the login in your scripts"

It's actually quite nice using a database server that doesn't require explicit credentials to be used.