# Create Readonly Db Role

Set up read-only PostgreSQL access for agents.

- Repository: https://github.com/davidondrej/skills (4238 stars)
- Category: AI and agents
- License: MIT
- Last updated: 2026-11-01
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add davidondrej/skills --skill create-readonly-db-role -g -a claude-code -y`
Codex: `npx skills add davidondrej/skills --skill create-readonly-db-role -g -a codex -y`
Cursor: `npx skills add davidondrej/skills --skill create-readonly-db-role -g -a cursor -y`
Gemini CLI: `npx skills add davidondrej/skills --skill create-readonly-db-role -g -a gemini-cli -y`

## Description

Set up read-only PostgreSQL access for agents. Use only when the user explicitly invokes /create-readonly-db-role.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Create a Read-Only DB Role for Agents

Prepare a SELECT-only role and protected connection. The SQL, role name, grants, denylist, RLS setting, timeouts, and connection steps are examples to adapt to your system, not live production configuration.

## Access model

1. **SELECT-only grants.** Grant no write permissions; use a denylist to exclude secrets and PII.
2. **Current and future tables.** Grant SELECT on all tables in `public`, including future tables through default privileges, then revoke denylisted tables. Never grant the `auth` schema. New sensitive tables need a manual revoke.
3. **Soft guardrails.** Set `default_transaction_read_only = on` and a short `statement_timeout` suited to the workload.

**RLS:** tables may return no rows when the role has no applicable policy. Consider `bypassrls` only if it fits your security model: it skips row filtering, while grants and the denylist still apply.

## Workflow

The rest: https://github.com/davidondrej/skills/blob/HEAD/skills/ops-and-setup/create-readonly-db-role/SKILL.md