Re: PostgreSQL 17: RLS, SECURITY DEFINER and migration role safety questions

On Tue, Oct 13, 2026 at 10:15 AM Samir Gadzhiev <mr(dot)sperrow111(at)gmail(dot)com> wrote:
> - Dedicated NOLOGIN roles owning SECURITY DEFINER functions
> - Restricted EXECUTE privileges and explicit search_path

Hi. I can't answer most of your questions.
But I'll share this, after using SECURITY DEFINER for a while now.

Something I wish I had known earlier is to use SCHEMAs for "security scoping".
See, having EXECUTE on a func/proc is not enough, you also need USAGE
on its SCHEMA.
I have a mix of INVOKER and DEFINER func/proc, and w/o separation into
distinct SCHEMAs,
it's harder to control and QC their access (i.e. grants). In my kinda
mature and largish system,
it's not easy to do the split after the fact. So plan that early and
from the get go, if you can.

SCHEMAs are you friends IMHO. Use them to organize/group your objects
based on security requirements.

My $0.02. --DD