> For the complete documentation index, see [llms.txt](https://docs.inrupt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.inrupt.com/ess/3.1/readme.md).

# ESS 3.1

ESS 3.1 builds on [ESS 3.0](/ess/3.1/introduction.md) by introducing least-privilege database credential separation for all PostgreSQL-backed services, reducing the blast radius of a compromised credential.

## What's new in 3.1

**Database Credential Separation** — ESS services now support separate DDL credentials (used by Flyway at startup for schema migrations) and DML credentials (used at runtime for application queries). DML credentials are restricted to read/write operations only and cannot modify the database schema. The credential split is opt-in; in the default configuration both credentials reference the same Kubernetes secret, so no changes are required to upgrade. See [3.x Changelogs](/ess/3.1/releases/changelog.md) for configuration details.

## Get started

{% content-ref url="/pages/kokE9iIFN6uKIuotwY9Y" %}
[Introduction](/ess/3.1/introduction.md)
{% endcontent-ref %}

{% content-ref url="/pages/3TDGOXZV5tWdmYc0gHMk" %}
[Installation](/ess/3.1/installation.md)
{% endcontent-ref %}

{% content-ref url="/pages/WRpY3nqkyiZ4igc9G8tb" %}
[ESS Services](/ess/3.1/services.md)
{% endcontent-ref %}

{% content-ref url="/pages/zeAdjztnVCZUi0plDPbd" %}
[Administration](/ess/3.1/administration.md)
{% endcontent-ref %}

{% content-ref url="/pages/oxDF1peir5JUhinez1xb" %}
[Release Notes](/ess/3.1/releases.md)
{% endcontent-ref %}