You have a Microsoft SQL Server 2025 instance that contains a database named SalesDB SalesDB supports a Retrieval Augmented Generation (RAG) pattern…

Because the SQL Server 2025 instance has no outbound connectivity, you must host the embedding model locally. Creating an external model project that references an ONNX file stored on local paths (D) places the model inside the database environment. EXECUTE permission on that external model project must then be granted (C) so that only AlApplicationUser can invoke AIGENERATEEMBEDDINGS, limiting model use to the authorised account.

A. CONTROL gives far broader rights than needed and is not specific to model execution.

B. Auditing records activity but does not prevent unauthorised execution.

E. A Foundry REST endpoint requires outbound network access, which the server does not have.

1. SQL Server 2025 (preview) – “CREATE EXTERNAL MODEL (Transact-SQL)” documentation, sections “LOCALFILE” and “ONNXRUNTIME” (Microsoft Learn, 2024).

2. SQL Server 2025 – “GRANT (Model)” syntax: GRANT EXECUTE ON MODEL::modelname TO username (Microsoft Learn, 2024).

3. SQL Server 2025 – “Using external models without network connectivity” white-paper, p. 4 (“local path deployment with ONNX runtime”).