---
title: "Give the app a least-privilege database · Agent Wranglers"
url: https://agentwranglers.se/playbook/data/operations/app-database-role
updated: 2026-10-20
licence: "All rights reserved"
---

# Give the app a least-privilege database user

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Operations](https://agentwranglers.se/playbook/data/operations)
- Rule: Connect the app with a user that can read and write its tables, but cannot change the schema or read other databases.
- How: Run migrations with a separate owner role. Grant the app role only `SELECT`, `INSERT`, `UPDATE` and `DELETE` on its tables, including tables that later migrations create. In PostgreSQL, add `USAGE` on sequences that `serial` columns use. Reporting tools get a read-only role on a replica. Connect over TLS, as the [encrypt data rule](https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets/encrypt-data) says.
- Check: Through the app's connection, try `DROP TABLE` on a test table. The database refuses it.

Example:

```sql
CREATE ROLE shop_app LOGIN;
GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO shop_app;
GRANT USAGE ON ALL SEQUENCES IN SCHEMA public TO shop_app;
-- Run as the owner role, so tables from later migrations get the same grants
ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO shop_app;
ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT USAGE ON SEQUENCES TO shop_app;
```

```sql
-- MySQL
CREATE USER 'shop_app'@'10.0.%' IDENTIFIED BY '...' REQUIRE SSL;
GRANT SELECT, INSERT, UPDATE, DELETE ON shop.* TO 'shop_app'@'10.0.%';
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers data playbook: https://agentwranglers.se/playbook/data/operations/app-database-role`.

- Previous: [Watch size and growth](https://agentwranglers.se/playbook/data/operations/capacity)
- [Operations](https://agentwranglers.se/playbook/data/operations)