Only Basic
To grant only basic access, assign a read-only role to your user accounts. Remove all admin, write, and delete rights from the default group profile. Many teams start by giving every new developer a shared admin key. Broad roles let one bad command drop tables or expose private customer data. A small role set stops most accidents before they start. How to set up only basic roles in your system First, list every database, server, and cloud app your team uses daily. Create a baseline role that
Read-Only Root Filesystem: the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
To grant only basic access, assign a read-only role to your user accounts. Remove all admin, write, and delete rights from the default group profile. Many teams start by giving every new developer a shared admin key. Broad roles let one bad command drop tables or expose private customer data. A small role set stops most accidents before they start.
How to set up only basic roles in your system
First, list every database, server, and cloud app your team uses daily. Create a baseline role that lets users view tables or read system status. Strip out rights that modify schemas, restart servers, or change security rules. Map this baseline role to your identity provider group for new staff.
Next, separate production accounts from test accounts across all of your cloud projects. Give developers full control in test spaces so they can build fast. Keep production locked down to the baseline view role at all times. Check your group memberships every month to remove old accounts and unused keys.
When someone needs to fix a live bug, do not upgrade their role forever. Grant a higher role for a short window and log the ticket number. Once the fix is done, return the account to the baseline state. This habit keeps role sprawl from creeping back into your production setup.
What static roles solve and what they miss
Static roles decide who can log in and which objects they can touch. They block a junior account from dropping a database or deleting a server. They also help auditors see a clean list of who holds admin rights. For basic gatekeeping, native database and cloud roles work well.
Still, a read-only role still lets a user read every row in a table by default. Anyone with basic select rights can pull emails, phone numbers, and card numbers. Static roles cannot tell a safe query from a full table dump. Once the login succeeds, the system trusts every read command inside that session.
Read-Only Root Filesystem: architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
Native roles also struggle when engineers need to run one safe write command. If you grant write rights for one row, the user can update the whole table. Static settings act at the account level, not on each command in flight. Teams need a way to check individual statements and rewrite sensitive fields in results.
Best practices for reviewing basic access
Start by logging every query and command that runs against your live data stores. Store those logs in a central place where users cannot edit or delete them. Review the logs each week to spot accounts that pull large data sets. If a service account only reads one table, shrink its role to that table.
Rotate static keys and passwords on a strict schedule to limit leaked credentials. Better yet, tie every database and server login to your central identity provider. When a person leaves the team, turning off their main login should stop everything. Keep your baseline roles small, clear, and easy for any team lead to check.
Add runtime guardrails and masking beside your databases and APIs
Login rules, role grants, and CI checks govern who connects to your stack. Yet any allowed script, engineer, or AI agent still runs commands with the full scope of its role. For workloads on Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes, SSH, or internal HTTP services, hoop.dev sits beside the service as an open-source proxy, a sidecar for your database or API.
Before a query runs, hoop.dev guardrails check the statement against your rules. An AI Analyzer you configure can score intent or hold risky calls for human review. Next, hoop.dev data masking rewrites sensitive fields in responses, and each verdict is logged per listener. Explore the MIT-licensed project on GitHub.
Frequently asked questions
What does only basic access mean for a database user?
It means the user can run select queries on approved tables and views. The account cannot insert rows, update data, drop tables, or change user roles.
Can a read-only role stop data leaks?
No, a read-only role still returns raw emails, phone numbers, and card numbers. You need field masking to rewrite sensitive columns before results reach the user.
How often should teams review basic user roles?
Teams should check all user roles and group mappings at least once a quarter. Automated alerts should also flag any account that gains admin rights outside normal workflows.