How to secure a SQL Server repository?

[skiwi]

We host some of our EA repositories in SQL server databases.

We use an active directory group to allow access to date database itself,
and EA to provide application role security.

I have not been able to find any EA document describing this.

What I want to know is what are the minimum permissions the AD group requires for EA to work,
and if I can have EA work while not allowing user's access to the underlying database.

Any help you can give me would be much appreciated

thanks

Simon