# Apply PostgreSQL default grants to the role that actually creates objects

> Test default grants through the real PostgreSQL migration identity before approving deployment access.

- Canonical URL: https://update.dsesecurity.com/updates/apply-postgresql-default-grants-to-the-role-that-actually-creates-objects/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-15T13:32:41+00:00
- Modified: 2026-10-15T13:36:15+00:00
- Last reviewed by DSE: 2026-10-15
- Resource type: Guide
- DSE priority: Information
- Topics: Business Continuity, IT
- Reading time: 2 minutes

## What you need to know

Test default grants through the real PostgreSQL migration identity before approving deployment access.

## Potentially affected

This applies to PostgreSQL 17 schema deployment and privilege administration. It addresses future-object grant behavior and does not replace reviewing existing object permissions or application access requirements.

## DSE recommendation

DSE recommends identifying the effective object-creating role used by each migration path before adjusting default grants.

## Article

Test default grants through the real PostgreSQL migration identity before approving deployment access.

## Source facts

PostgreSQL 17 ALTER DEFAULT PRIVILEGES changes permissions for future objects, not objects that already exist. At creation time, the defaults of the current role apply; defaults are not inherited simply because that role belongs to another role. Defaults can be global within a database or scoped to specified schemas. Consequently, changing a convenient administrator’s defaults may not change the permissions on tables subsequently created by a different application migration role.

Source: [PostgreSQL 17 — ALTER DEFAULT PRIVILEGES](https://www.postgresql.org/docs/17/sql-alterdefaultprivileges.html).

## Applicability

This applies to PostgreSQL 17 schema deployment and privilege administration. It addresses future-object grant behavior and does not replace reviewing existing object permissions or application access requirements.

## DSE recommendation

DSE recommends identifying the effective object-creating role used by each migration path before adjusting default grants. Keep a separate inventory of current objects that need a reviewed permission change. Have the application owner define the minimum intended access and distinguish tables, sequences, and other object types where relevant. Test the real deployment identity rather than an administrator’s interactive session. Store the approved grant policy with deployment documentation so later tooling changes do not silently change ownership assumptions.

## Verification

In a test schema, create representative objects using the actual migration role and inspect their resulting privileges. Compare an object created before the change with one created afterward. Confirm required application actions succeed and unintended access fails without granting broader rights just to make the test pass.

## Official reference

[PostgreSQL 17 — ALTER DEFAULT PRIVILEGES](https://www.postgresql.org/docs/17/sql-alterdefaultprivileges.html). Reviewed October 15, 2026.

## Primary reference

- Name: PostgreSQL 17 — ALTER DEFAULT PRIVILEGES
- Authority: www.postgresql.org
- URL: https://www.postgresql.org/docs/17/sql-alterdefaultprivileges.html
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Apply PostgreSQL default grants to the role that actually creates objects,” DSE Security, https://update.dsesecurity.com/updates/apply-postgresql-default-grants-to-the-role-that-actually-creates-objects/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.