I'm establishing a shared development instance for multiple single-database applications.
I'm envisioning granting authorized users permissions to allow any schema and data modifications they need to perform, but want to prevent the same users from issuing
ALTER DATABASE commands to
FILEs. This is to prevent any one developer from consuming additional disk space resources without consent from the DBA.
Looking at an approach using the least administrative effort, I'm thinking I should
grant db_owner to the authorized users and add a database or server trigger to block
ALTER DATABASE commands unless they come from DBA sessions.
Would this work or is there a better/safer approach?