grant-runtime.sql

SQL · 25 lines · 1,890 bytes · wiki path 10 Architecture/db/SrdSupport/grant-runtime.sql · download the raw file · cited from Data Model — `SRD_SUPPORT`

Same folder: 001-work-and-planning.sql · 002-decisions-and-grants.sql · 003-evidence.sql · 004-ledger.sql · 005-registry.sql · 006-memory.sql · 007-policy-and-operations.sql · 008-immutability-and-payload-guards.sql · 009-seed-platform-policy.sql · 010-runtime-execution.sql · acceptance-install-clean.sql · acceptance-upgrade.sql · install-clean.sql · lint_ddl.py · upgrade.sql · verify-ledger.sql · verify-schema.sql

SET DEFINE ON
WHENEVER SQLERROR EXIT SQL.SQLCODE

-- D47: SRD_SUPPORT is ONE user — schema owner and runtime principal alike; the owner/runtime split of SrdAi is not carried.
-- So there is no runtime role to grant to. This script exists for the two read-only consumers the platform allows:
--   * a REPORTING role for the Metrics parsers and Kibana dashboards (SELECT on the ledger projections only — never on
--     CASE_HANDLES, CASE_KEYS or PAPERS, whose contents are the data boundary);
--   * nothing else. Estate schemas are reached through connectors under grants, never through database grants.
-- Supply the role name before execution, for example:
-- DEFINE SRD_SUPPORT_REPORTING_ROLE = 'SRD_SUPPORT_REPORTING'

GRANT SELECT ON "SRD_SUPPORT"."AUDIT_LEDGER"      TO &&SRD_SUPPORT_REPORTING_ROLE;
GRANT SELECT ON "SRD_SUPPORT"."LEDGER_SEALS"      TO &&SRD_SUPPORT_REPORTING_ROLE;
GRANT SELECT ON "SRD_SUPPORT"."LEDGER_EXPORTS"    TO &&SRD_SUPPORT_REPORTING_ROLE;
GRANT SELECT ON "SRD_SUPPORT"."COST_LEDGER"       TO &&SRD_SUPPORT_REPORTING_ROLE;
GRANT SELECT ON "SRD_SUPPORT"."CASES"             TO &&SRD_SUPPORT_REPORTING_ROLE;
GRANT SELECT ON "SRD_SUPPORT"."TASKS"             TO &&SRD_SUPPORT_REPORTING_ROLE;
GRANT SELECT ON "SRD_SUPPORT"."GATES"             TO &&SRD_SUPPORT_REPORTING_ROLE;
GRANT SELECT ON "SRD_SUPPORT"."GATE_DECISIONS"    TO &&SRD_SUPPORT_REPORTING_ROLE;
GRANT SELECT ON "SRD_SUPPORT"."HELD_BATCHES"      TO &&SRD_SUPPORT_REPORTING_ROLE;
GRANT SELECT ON "SRD_SUPPORT"."WRITE_SHAPES"      TO &&SRD_SUPPORT_REPORTING_ROLE;
GRANT SELECT ON "SRD_SUPPORT"."EVAL_RUNS"         TO &&SRD_SUPPORT_REPORTING_ROLE;
GRANT SELECT ON "SRD_SUPPORT"."CONNECTOR_HEALTH"  TO &&SRD_SUPPORT_REPORTING_ROLE;
GRANT SELECT ON "SRD_SUPPORT"."MEMORY_ARTICLES"   TO &&SRD_SUPPORT_REPORTING_ROLE;
GRANT SELECT ON "SRD_SUPPORT"."EXPERIENCE_ENTRIES" TO &&SRD_SUPPORT_REPORTING_ROLE;