The database waits. It holds every record, every permission, every layer of access that defines your system’s truth. In Mosh, roles are the backbone of that control. They decide who can read, who can write, who can execute commands that change the shape of data.
Understanding Mosh Database Roles
A role in Mosh is more than a username or a token of identity. It is a set of privileges bound to security rules. These roles can own objects, grant rights, and inherit permissions from other roles. With precise configuration, you can give a role authority over specific schemas, tables, views, or server functions without exposing anything unnecessary.
Creating Roles
Use CREATE ROLE to define a new identity in the database. You can assign attributes such as LOGIN, SUPERUSER, or CREATEDB. By default, a new role has no inherent rights until you grant them. Keep your scope tight—there is no reason to give administrative access where read-only will suffice.
Granting Privileges
Privileges in Mosh are organized by actions: SELECT, INSERT, UPDATE, DELETE, EXECUTE. Use GRANT statements to connect roles to these privileges. Always pair privilege grants with REVOKE where needed to keep permissions clean and auditable.