Database roles sound simple—grant permissions, restrict access, done. But in practice, they're a minefield of hidden pain points. Different engines, different defaults, different permission scopes. One wrong role assignment and suddenly a critical service can't read data, or worse, someone has write access to production tables they should never touch.
The core pain point is fragmentation. PostgreSQL roles don’t work like MySQL privileges. MongoDB’s role-based access control speaks an entirely different language. And when cloud providers add their own layers—AWS IAM policies, GCP service accounts, Azure AD roles—the complexity multiplies. The documentation for each system exists in isolation, leaving you to stitch it together by hand.
The second pain point is visibility. Most teams can’t answer a simple question: who can do what, right now, in production? Security audits often turn into detective work, piecing together grants, roles, and inherited permissions from scattered scripts and console screenshots. Without a unified map, you’re guessing.