Security Policy

Security in Katzebase is enforced through roles and the membership of accounts in those roles. Roles come in two varieties: administrators and non-administrators.
Permissions can be granted, denied or revoked individually (READ, WRITE, MANAGE), or all at once with the special ALL permission.


Administrators have unrestricted access to the database: all schemas and data, and every feature, including creating accounts and roles, managing memberships, configuration, and the system procedures that are restricted to administrators. An account that is a member of any role marked IsAdministrator is an administrator. The built-in admin account is a member of the Administrators role.
Accounts, roles and memberships can be viewed by querying the Master schema.

SELECT * FROM Master:Account
SELECT * FROM Master:Role
SELECT * FROM Master:Membership

Creates an account.

CREATE ACCOUNT JohnDoe WITH (Password = '123abc!')

Drops an account.

DROP ACCOUNT JohnDoe

Creates a role.

CREATE ROLE Salespersons

Creates an administrator role.

CREATE ROLE SalesAdmins WITH (IsAdministrator = true)

Adds an account to a role, and removes it again.

ALTER ROLE Salespersons ADD JohnDoe
ALTER ROLE Salespersons REMOVE JohnDoe

Drops a role.

DROP ROLE SalesAdmins

Schema security is enforced by granting or denying permissions to roles.

Permissions are applied from the root down and can be overridden at any level, either by a policy for a specific schema or by another recursive policy.
To determine an account's permissions on a schema, the engine first checks the policies of the schema itself. Any permission that is still undefined is then looked up in the recursive policies of the schema's parent, and so on up to the root, until every permission has a rule.
This way you can deny a permission recursively at one level and then override it with a grant at a lower level.
These checks are skipped for administrators.

Read permission allows an account to select from a schema and, with Recursive, from the schemas beneath it.
Allows a role to read from the WordList:Word schema.

GRANT READ ON WordList:Word TO Salespersons

Allows a role to read from WordList and every schema beneath it.

GRANT READ ON WordList TO Salespersons WITH (Recursive = true)

Prevents a role from reading from WordList:Word.

DENY READ ON WordList:Word TO Salespersons

Write permission allows an account to insert, update and delete documents. GRANT WRITE and DENY WRITE follow the same conventions as READ.
Allows a role to write to WordList and every schema beneath it.

GRANT WRITE ON WordList TO Salespersons WITH (Recursive = true)

Manage permission allows an account to manage a schema: create, drop, rebuild and analyze indexes, create child schemas, and grant or deny permissions on the schema to other roles.
Allows a role to manage WordList and every schema beneath it.

GRANT MANAGE ON WordList TO Salespersons WITH (Recursive = true)

Grants every permission on a schema.

GRANT ALL ON WordList:Language TO Salespersons

Revoking does not deny a permission; it removes the explicit policy, so the permission is inherited again.
Removes every explicit policy for a role from a schema.

REVOKE ALL ON WordList:Language FROM Salespersons

Removes the explicit MANAGE policy.

REVOKE MANAGE ON WordList FROM Salespersons

• ShowSchemaPolicy('Schema'): shows the policy that applies to a schema.
• ShowMySchemaPolicy('Schema'): shows your own permissions on a schema and where each was inherited from.
• RefreshMyRoles(): reloads your role memberships without logging in again.