class="parameter">role_name</replaceable> | PUBLIC } [, ...]
[ CASCADE | RESTRICT ]
REVOKE [ GRANT OPTION FOR ]
{ { USAGE | CREATE }
[, ...] | ALL [ PRIVILEGES ] }
ON SCHEMAS
FROM { [ GROUP ] <replaceable class="parameter">role_name</replaceable> | PUBLIC } [, ...]
[ CASCADE | RESTRICT ]
REVOKE [ GRANT OPTION FOR ]
{ { SELECT | UPDATE }
[, ...] | ALL [ PRIVILEGES ] }
ON LARGE OBJECTS
FROM { [ GROUP ] <replaceable class="parameter">role_name</replaceable> | PUBLIC } [, ...]
[ CASCADE | RESTRICT ]
</synopsis>
</refsynopsisdiv>
<refsect1 id="sql-alterdefaultprivileges-description">
<title>Description</title>
<para>
<command>ALTER DEFAULT PRIVILEGES</command> allows you to set the
privileges that will be applied to objects created in the future.
(It does not affect privileges assigned to already-existing objects.)
Privileges can be set globally (i.e., for all objects created in the
current database), or just for objects created in specified schemas.
</para>
<para>
While you can change your own default privileges and the defaults of
roles that you are a member of, at object creation time, new object
permissions are only affected by the default privileges of the current
role, and are not inherited from any roles in which the current role
is a member.
</para>
<para>
As explained in <xref linkend="ddl-priv"/>,
the default privileges for any object type normally grant all grantable
permissions to the object owner, and may grant some privileges to
<literal>PUBLIC</literal> as well. However, this behavior can be changed by
altering the global default privileges with
<command>ALTER DEFAULT PRIVILEGES</command>.
</para>
<para>
Currently,
only the privileges for schemas, tables (including views and foreign
tables), sequences, functions, types (including domains), and large objects
can be altered. For this command, functions include aggregates and procedures.
The words <literal>FUNCTIONS</literal> and <literal>ROUTINES</literal> are
equivalent in this command. (<literal>ROUTINES</literal> is preferred
going forward as the standard term for functions and procedures taken
together. In earlier PostgreSQL releases, only the
word <literal>FUNCTIONS</literal> was allowed. It is not possible to set
default privileges for functions and procedures separately.)
</para>
<para>
Default privileges that are specified per-schema are added to whatever
the global default privileges are for the particular object type.
This means you cannot revoke privileges per-schema if they are granted
globally (either by default, or according to a previous <command>ALTER
DEFAULT PRIVILEGES</command> command that did not specify a schema).
Per-schema <literal>REVOKE</literal> is only useful to reverse the
effects of a previous per-schema <literal>GRANT</literal>.
</para>
<refsect2>
<title>Parameters</title>
<variablelist>
<varlistentry>
<term><replaceable>target_role</replaceable></term>
<listitem>
<para>
Change default privileges for objects created by the
<replaceable>target_role</replaceable>, or the current
role if unspecified.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term><replaceable>schema_name</replaceable></term>
<listitem>
<para>
The name of an existing schema. If specified, the default privileges
are altered for objects later created in that schema.
If