Re: PostgreSQL 17: RLS, SECURITY DEFINER and migration role safety questions

On Tue, Oct 13, 2026 at 11:45 AM Samir Gadzhiev <mr(dot)sperrow111(at)gmail(dot)com> wrote:
> One question, if you don't mind: would you generally recommend a dedicated schema for all privileged SECURITY DEFINER functions, or separate schemas for different security domains, such as authentication, sessions, and document access?

I would err on the side of granularity.

With too many SCHEMAs, it's easy to GRANT ... ON ALL ROUTINES IN
SCHEMA + GRANT USAGE ON SCHEMA.

While with too few, you're back to having to deal with per-routine
GRANTs, i.e. many more I suspect. If you have fewer security domains
than routines, that is, of course. You lose the benefit of SCHEMA-wide
granting.

For routines, SCHEMAs replace Oracle's packages.

Note that one thing I really miss from Oracle is the ability to grant
something to a particular routine (and not a role).

But TBH, I hope someone more experienced than me would chime as well :)
My uses of PostgreSQL is definitely not mainstream I fear. --DD