Give customers SQL access with isolation and cost caps.
Recent revisions are kept. Restoring one creates a new revision.
