Create Readonly Db Role
Set up read-only PostgreSQL access for agents.
Install
npx skills add davidondrej/skills --skill create-readonly-db-role -g -a claude-code -y- Repository
- davidondrej/skills4.2k
- Category
- AI and agents
- Updated
- 3d ago
- License
- MIT
- Context cost
- Lightabout 1,266 tokens
- Runs scripts
- No, instructions only
What it does
Set up read-only PostgreSQL access for agents. Use only when the user explicitly invokes /create-readonly-db-role.
Create a Read-Only DB Role for Agents
Prepare a SELECT-only role and protected connection. The SQL, role name, grants, denylist, RLS setting, timeouts, and connection steps are examples to adapt to your system, not live production configuration.
Access model
- SELECT-only grants. Grant no write permissions; use a denylist to exclude secrets and PII.
- Current and future tables. Grant SELECT on all tables in
public, including future tables through default privileges, then revoke denylisted tables. Never grant theauthschema. New sensitive tables need a manual revoke. - Soft guardrails. Set
default_transaction_read_only = onand a shortstatement_timeoutsuited to the workload.
RLS: tables may return no rows when the role has no applicable policy. Consider bypassrls only if it fits your security model: it skips row filtering, while grants and the denylist still apply.
