MIME-Version: 1.0
In-Reply-To: 
 <CAGA3vBug6Sq_XYLxzmY470WFS6Z3OF28goYzX=QHrCc4hgQSDw@mail.gmail.com>
References: 
 <CAGA3vBug6Sq_XYLxzmY470WFS6Z3OF28goYzX=QHrCc4hgQSDw@mail.gmail.com>
From: "David G. Johnston" <david.g.johnston@gmail.com>
Date: Tue, 9 Dec 2025 17:38:49 -0700
Message-ID: 
 <CAKFQuwZN+T10qAwtRRdjVjd_qXL=MsGeXZuFR_zhOUMH=NVBHw@mail.gmail.com>
Subject: Re: database specific pg_read_all_data / pg_write_all_data
To: richard coleman <rcoleman.ascentgl@gmail.com>
Cc: Pgsql-admin <pgsql-admin@lists.postgresql.org>
Content-Type: multipart/alternative; boundary="0000000000007ef99306458e40bb"
Archived-At: 
 <https://www.postgresql.org/message-id/CAKFQuwZN%2BT10qAwtRRdjVjd_qXL%3DMsGeXZuFR_zhOUMH%3DNVBHw%40mail.gmail.com>
Precedence: bulk

--0000000000007ef99306458e40bb
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Tuesday, December 9, 2025, richard coleman <rcoleman.ascentgl@gmail.com>
wrote:

> In PostgreSQL 16+ the built in roles such as pg_read_all_data
> and pg_write_all_data are a welcome addition to permission setting in
> PostgreSQL.
>
> Unfortunately they appear to be server-wide roles.
>
> Woud it be possible to have roles like these that are database specific?
>

 You can have roles that are database-specific; which then means those
roles can only apply the =E2=80=9Call data=E2=80=9D privileges within the d=
atabase they are
permitted access to.

David J.

--0000000000007ef99306458e40bb
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Tuesday, December 9, 2025, richard coleman &lt;<a href=3D"mailto:rcolema=
n.ascentgl@gmail.com">rcoleman.ascentgl@gmail.com</a>&gt; wrote:<br><blockq=
uote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc =
solid;padding-left:1ex"><div dir=3D"ltr">In PostgreSQL 16+ the built in rol=
es such as=C2=A0pg_read_all_data and=C2=A0pg_write_all_data are a welcome a=
ddition to permission setting in PostgreSQL.<div><br></div><div>Unfortunate=
ly they appear to be server-wide roles.</div><div><br></div><div>Woud it be=
 possible to have roles like these that are database specific?</div></div><=
/blockquote><div><br></div><div>=C2=A0You can have roles that are database-=
specific; which then means those roles can only apply the =E2=80=9Call data=
=E2=80=9D privileges within the database they are permitted access to.</div=
><div><br></div><div>David J.</div><div><br></div><blockquote class=3D"gmai=
l_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left=
:1ex">
</blockquote>

--0000000000007ef99306458e40bb--