Home Explore Blog CI



postgresql

2nd chunk of `doc/src/sgml/ref/alter_default_privileges.sgml`
d8a8ed7d82dac69faa6d4ecd1b7503483a2765715fe5caf00000000100000de4
 class="parameter">role_name</replaceable> | PUBLIC } [, ...]
    [ CASCADE | RESTRICT ]

REVOKE [ GRANT OPTION FOR ]
    { { USAGE | CREATE }
    [, ...] | ALL [ PRIVILEGES ] }
    ON SCHEMAS
    FROM { [ GROUP ] <replaceable class="parameter">role_name</replaceable> | PUBLIC } [, ...]
    [ CASCADE | RESTRICT ]

REVOKE [ GRANT OPTION FOR ]
    { { SELECT | UPDATE }
    [, ...] | ALL [ PRIVILEGES ] }
    ON LARGE OBJECTS
    FROM { [ GROUP ] <replaceable class="parameter">role_name</replaceable> | PUBLIC } [, ...]
    [ CASCADE | RESTRICT ]
</synopsis>
 </refsynopsisdiv>

 <refsect1 id="sql-alterdefaultprivileges-description">
  <title>Description</title>

  <para>
   <command>ALTER DEFAULT PRIVILEGES</command> allows you to set the
   privileges that will be applied to objects created in the future.
   (It does not affect privileges assigned to already-existing objects.)
   Privileges can be set globally (i.e., for all objects created in the
   current database), or just for objects created in specified schemas.
  </para>

  <para>
   While you can change your own default privileges and the defaults of
   roles that you are a member of, at object creation time, new object
   permissions are only affected by the default privileges of the current
   role, and are not inherited from any roles in which the current role
   is a member.
  </para>

  <para>
   As explained in <xref linkend="ddl-priv"/>,
   the default privileges for any object type normally grant all grantable
   permissions to the object owner, and may grant some privileges to
   <literal>PUBLIC</literal> as well.  However, this behavior can be changed by
   altering the global default privileges with
   <command>ALTER DEFAULT PRIVILEGES</command>.
  </para>

  <para>
   Currently,
   only the privileges for schemas, tables (including views and foreign
   tables), sequences, functions, types (including domains), and large objects
   can be altered.  For this command, functions include aggregates and procedures.
   The words <literal>FUNCTIONS</literal> and <literal>ROUTINES</literal> are
   equivalent in this command.  (<literal>ROUTINES</literal> is preferred
   going forward as the standard term for functions and procedures taken
   together.  In earlier PostgreSQL releases, only the
   word <literal>FUNCTIONS</literal> was allowed.  It is not possible to set
   default privileges for functions and procedures separately.)
  </para>

  <para>
   Default privileges that are specified per-schema are added to whatever
   the global default privileges are for the particular object type.
   This means you cannot revoke privileges per-schema if they are granted
   globally (either by default, or according to a previous <command>ALTER
   DEFAULT PRIVILEGES</command> command that did not specify a schema).
   Per-schema <literal>REVOKE</literal> is only useful to reverse the
   effects of a previous per-schema <literal>GRANT</literal>.
  </para>

 <refsect2>
  <title>Parameters</title>

  <variablelist>
   <varlistentry>
    <term><replaceable>target_role</replaceable></term>
    <listitem>
     <para>
      Change default privileges for objects created by the
      <replaceable>target_role</replaceable>, or the current
      role if unspecified.
     </para>
    </listitem>
   </varlistentry>

   <varlistentry>
    <term><replaceable>schema_name</replaceable></term>
    <listitem>
     <para>
      The name of an existing schema.  If specified, the default privileges
      are altered for objects later created in that schema.
      If

Title: ALTER DEFAULT PRIVILEGES - Description and Parameters
Summary
The `ALTER DEFAULT PRIVILEGES` command allows setting privileges for future objects. It doesn't affect existing objects. Privileges can be set globally or for specific schemas. New object permissions are affected by the current role's default privileges, not inherited from member roles. The command can alter privileges for schemas, tables, sequences, functions, types, and large objects. Schema-specific privileges add to global defaults. The target_role parameter specifies the role whose privileges are being altered, and schema_name specifies the schema for which the default privileges are being altered.