1. Make a SQL Server login with zero permissions 2. Start adding permissions until everything works. 3. Write those permissions down somewhere.