There are three different roles that are defined in BSM which have access to the database.
Data Source Manager
This role enables users to create data sources. Users who have permissions for the Data Source Manager role can also publish data sources to the database.
Scorecard Server Manager
This role enables users to create KPIs, scorecards and indicators - any scorecard element other than data sources. Users who have permissions for the Scorecard Server Manager role can also publish scorecard elements to the database. Users who have permissions for the Scorecard Server Manager role can delete elements where they also have permissions for the Editor role.
This role grants read-only access to all scorecard elements in the Business Scorecard Manager system. It enables users to download scorecard objects from a server on which the database is installed and view those objects in Business Scorecard Builder.
It is necessary for SQL administrators to grant the account read and write permissions to the Scorecard Server database. And in addition, an OLAP administrator must add the IIS application pool account to the OLAP Users group on the computer that is running Microsoft SQL Server Analysis Services.
BSM establishes a connection with the data sources by using the IIS application pool account used by Windows SharePoint Services or SharePoint Portal Server. This configuration ensures that no unauthorized user can access the computer running SQL Server, and that only the account designated for database access will be able to access scorecard metadata in the scorecard database.