Roles and privileges
The privilege boundary as the database states it. Bootstrap creates two login roles: taisce_control, which reads the credential registry, and taisce_data, which serves memory. Migrations and project provisioning run as the administrative identity, which owns every object. A serving process refuses to start on a connection whose effective privileges are wider than its role's.
Role attributes
| Role | Login | Superuser | Create role | Create database | Replication | Bypass row security | Member of |
|---|---|---|---|---|---|---|---|
taisce_control | yes | no | no | no | no | no | — |
taisce_data | yes | no | no | no | no | no | — |
Database and namespaces
| Object | Role | Privileges |
|---|---|---|
database taisce_docsite_fad0851e04476d38 | PUBLIC | CONNECT, TEMPORARY |
namespace control | taisce_control | USAGE |
namespace memory | taisce_data | USAGE |
The database name is the scratch database the reference was built in; a deployment's has its own name and the same grants.
Tables in control
What each role may do to each table. The owner, which may do everything, is not listed.
| Table | taisce_control | taisce_data | PUBLIC |
|---|---|---|---|
| credential | select | — | — |
| schema_migration | select | — | — |
Tables in memory
What each role may do to each table. The owner, which may do everything, is not listed.
| Table | taisce_control | taisce_data | PUBLIC |
|---|---|---|---|
| agent_artifact | — | delete, insert, select, update | — |
| agent_storage_policy | — | select | — |
| audit_entry | — | insert, select | — |
| audit_seal | — | select | — |
| chunk | — | delete, insert, select, update | — |
| community | — | delete, insert, select, update | — |
| community_member | — | delete, insert, select, update | — |
| community_report | — | delete, insert, select, update | — |
| curated_claim | — | delete, insert, select, update | — |
| data_subject | — | delete, insert, select, update | — |
| embedding_active | — | select | — |
| embedding_build | — | delete, insert, select, update | — |
| embedding_generation | — | select | — |
| entity | — | delete, insert, select, update | — |
| entity_embedding | — | delete, insert, select, update | — |
| entity_embedding_active | — | select | — |
| entity_embedding_build | — | delete, insert, select, update | — |
| entity_embedding_generation | — | select | — |
| entity_embedding_source | — | delete, insert, select, update | — |
| entity_embedding_target | — | delete, insert, select, update | — |
| entity_name_receipt | — | delete, insert, select, update | — |
| erasure_request | — | delete, insert, select, update | — |
| fact | — | delete, insert, select, update | — |
| fact_evidence | — | delete, insert, select, update | — |
| fact_generation | — | delete, insert, select, update | — |
| fact_generation_record | — | delete, insert, select, update | — |
| fact_history | — | delete, insert, select, update | — |
| fact_rebuild_job | — | delete, insert, select, update | — |
| fact_receipt | — | delete, insert, select, update | — |
| fact_receipt_history | — | delete, insert, select, update | — |
| formation_health | — | delete, insert, select, update | — |
| ingestion_budget | — | select | — |
| ingestion_project_usage | — | select | — |
| ingestion_reservation | — | select | — |
| memory_feedback | — | delete, insert, select, update | — |
| message_embedding | — | delete, insert, select, update | — |
| notification_delivery | — | delete, insert, select, update | — |
| notification_endpoint | — | delete, insert, select, update | — |
| observation | — | delete, insert, select, update | — |
| observation_retry | — | delete, insert, select, update | — |
| predicate | — | select | — |
| project | — | select | — |
| projection_dependency | — | delete, insert, select, update | — |
| projection_kind | — | select | — |
| record_retraction | — | delete, insert, select, update | — |
| rejected_claim | — | delete, insert, select, update | — |
| report_embedding | — | delete, insert, select, update | — |
| report_embedding_active | — | select | — |
| report_embedding_build | — | delete, insert, select, update | — |
| report_embedding_generation | — | select | — |
| report_embedding_source | — | delete, insert, select, update | — |
| report_embedding_target | — | delete, insert, select, update | — |
| retention_sweep | — | insert, select | — |
| schema_migration | — | select | — |
| segment | — | delete, insert, select, update | — |
| source_extraction | — | delete, insert, select, update | — |
| speaker_term | — | select | — |
| subject_retry | — | delete, insert, select, update | — |
| turn_message | — | delete, insert, select, update | — |
| unresolvable_term | — | select | — |
| watermark | — | delete, insert, select, update | — |