Why should you care?

PostgresVerse interns get read-only on staging schemas, not SUPERUSER — RBAC prevents DROP DATABASE accidents.

See it live — copy this example

Run in pgAdmin or psql.

CREATE ROLE analyst LOGIN PASSWORD '***';
GRANT CONNECT ON DATABASE "PostgresVerse" TO analyst;
GRANT USAGE ON SCHEMA public TO analyst;
GRANT SELECT ON ALL TABLES IN SCHEMA public TO analyst;
ALTER DEFAULT PRIVILEGES IN SCHEMA public
  GRANT SELECT ON TABLES TO analyst;

What happened?

• analyst connects and reads public tables.
• DEFAULT PRIVILEGES auto-grants SELECT on future tables — critical for migrations adding tables monthly.

Practice next

1. CREATE ROLE analyst and GRANT as shown.
2. Login as analyst in psql -U analyst -d PostgresVerse.
3. Try SELECT ok; INSERT denied.
4. Column-level GRANT SELECT (email) ON customers.
5. CREATE ROLE readwrite IN ROLE analyst GRANT INSERT,UPDATE.

Remember

Roles can inherit via GRANT role TO role. Least privilege per service account. REVOKE when offboarding contractors.

PostgresVerse RBAC rollout

Each microservice gets unique role with 3-table GRANT set; vault stores passwords.

Outcome: Blast radius of leaked creds limited to one domain.