On Tue, Oct 13, 2026 at 10:15 AM Samir Gadzhiev <[email protected]> wrote: > - Dedicated NOLOGIN roles owning SECURITY DEFINER functions > - Restricted EXECUTE privileges and explicit search_path
Hi. I can't answer most of your questions. But I'll share this, after using SECURITY DEFINER for a while now. Something I wish I had known earlier is to use SCHEMAs for "security scoping". See, having EXECUTE on a func/proc is not enough, you also need USAGE on its SCHEMA. I have a mix of INVOKER and DEFINER func/proc, and w/o separation into distinct SCHEMAs, it's harder to control and QC their access (i.e. grants). In my kinda mature and largish system, it's not easy to do the split after the fact. So plan that early and from the get go, if you can. SCHEMAs are you friends IMHO. Use them to organize/group your objects based on security requirements. My $0.02. --DD
