On Tue, Oct 13, 2026 at 11:45 AM Samir Gadzhiev <[email protected]> wrote: > One question, if you don't mind: would you generally recommend a dedicated > schema for all privileged SECURITY DEFINER functions, or separate schemas for > different security domains, such as authentication, sessions, and document > access?
I would err on the side of granularity. With too many SCHEMAs, it's easy to GRANT ... ON ALL ROUTINES IN SCHEMA + GRANT USAGE ON SCHEMA. While with too few, you're back to having to deal with per-routine GRANTs, i.e. many more I suspect. If you have fewer security domains than routines, that is, of course. You lose the benefit of SCHEMA-wide granting. For routines, SCHEMAs replace Oracle's packages. Note that one thing I really miss from Oracle is the ability to grant something to a particular routine (and not a role). But TBH, I hope someone more experienced than me would chime as well :) My uses of PostgreSQL is definitely not mainstream I fear. --DD
