https://beh74.github.io/pgassistant-blog/tags/roles/Recent content in Roles on pgAssistant BlogHugo -- 0.147.0en-usSat, 25 Jul 2026 00:00:00 +0000https://beh74.github.io/pgassistant-blog/post/pgassistant_security/Sat, 25 Jul 2026 00:00:00 +0000https://beh74.github.io/pgassistant-blog/post/pgassistant_security/<h2 id="purpose">Purpose</h2> <p>pgAssistant inspects PostgreSQL configuration, system catalogs, statistics, schemas, relations, sequences, and query plans. Some optional features can also run maintenance operations or reset statistics.</p> <p>This document recommends separating these capabilities between two login roles:</p> <ul> <li><code>pgassistant_analyze</code>: the default, read-only account used for dashboards, reports, advisors, query ranking, query plans, and database design analysis.</li> <li><code>pgassistant_maintain</code>: a privileged account used only when an operator explicitly requests maintenance, such as <code>VACUUM</code>, <code>ANALYZE</code>, or a statistics reset.</li> </ul> <p>The maintenance role inherits the analysis role, so it can perform the same diagnostic work in addition to its explicitly granted maintenance operations.</p>