Authorization & Role-Based Access Control (RBAC)

CrateDB’s authorization model is based on roles that encapsulate permissions.
A role represents a set of privileges that can be assigned to one or more users.

• Roles: Logical groupings of privileges (e.g., analyst, developer, admin).
• Privileges: Specific rights such as DQL (read/query), DML (write/modify), or DDL (schema changes).
• Inheritance: Roles can be nested, allowing hierarchical permission models that mirror organizational structure.
• Schema-level and table-level granularity: Define permissions precisely where they’re needed.
• Dynamic management: Roles and privileges can be modified on the fly, without downtime.

In CrateDB Cloud, role-based permissions can be managed directly through the Cloud Console or API.
In self-managed deployments, RBAC is configured using standard SQL commands (e.g., CREATE ROLE, GRANT, REVOKE).

• Least privilege enforcement:  Limit data access to what users actually need.
• Operational safety: Reduce the risk of accidental or unauthorized modifications.
• Multi-tenant security: Segregate access between teams, applications, or customers.
• Compliance-ready: Implement controls aligned with ISO 27001 and SOC 2 principles.

• Create role hierarchies (e.g., viewer → editor → admin) for clarity and scalability.
• Regularly audit role assignments to detect unused or excessive privileges.
• Combine RBAC with Audit Logging for full traceability.
• Apply schema-based isolation in multi-tenant environments.
• Manage service accounts separately from human user accounts.