DB Access Manager

Visual RBAC management interface for all Wasteology PostgreSQL databases. Provides a structured view of schema-level permissions and supports staging, previewing, and applying grant/revoke changes through a dry-run gate.

Page Overview

DB Access Manager

View and manage PostgreSQL schema permissions across prod and dev with dry-run diffing and an audit log

How to Use

1Select the target database (prod or dev) from the top selector

2Review the Access Matrix tab for a full user-by-schema permission grid

3Switch to Edit mode to stage grant/revoke changes

4Run a dry-run preview — review the SQL diff before applying

5Click Apply Now to commit the changes (only enabled when dry-run is clean)

Features

🗺️

Access Matrix

Emoji-badge permission grid showing every user's access level per schema at a glance

👤

User Management

Per-user schema access list with inline grant and revoke actions

🎭

Role Management

Role list with member management — add or remove members from any role

📜

Audit Log

Filterable activity log of all grant/revoke operations with actor, operation, and result

Access Matrix

The Access Matrix tab renders a grid with users as rows and schemas as columns.

Permission Badges

Badge	Level	SQL Privilege
⚫	OWNER	Object owner — full control including DROP
🔴	ADMIN	USAGE + CREATE on schema, full table privileges
🟠	RW	USAGE + SELECT, INSERT, UPDATE, DELETE
🟢	READ	USAGE + SELECT only
⬜	—	No access

Role Inheritance

The matrix resolves full permission inheritance through role chains. A user granted azure_pg_admin will show the effective permission level, not just the direct grant. This uses a recursive CTE on pg_auth_members.

Edit Mode

Toggle Edit Mode in the top-right to switch the grid from read-only badge display to an interactive selector per cell. Changes are staged locally until you run a dry-run.

Dry-Run Flow

All mutations go through a mandatory dry-run gate before being applied.

1. Stage changes in Edit Mode
2. Click Review — opens the dry-run dialog
3. Palantiri wraps the SQL in a BEGIN … ROLLBACK transaction and executes it against the target database
4. The dialog shows the generated SQL and any errors from the dry run
5. Apply Now is only enabled when the dry run produces zero errors
6. Click Apply Now to execute the SQL in a real BEGIN … COMMIT transaction

Mutation Permission Required

The Review and Apply Now buttons are only visible to users whose displayName is in the DBACCESS_MUTATION_ALLOWLIST environment variable (comma-separated, e.g., Kent Gray,TJ Lewis). Other users see the matrix in read-only mode.

Users Tab

The Users tab provides a per-user view listing every schema and the access level for each. Inline Grant and Revoke buttons are available for admin users.

Column	Description
Schema	Schema name in the selected database
Access Level	Effective permission badge
Direct Grant	Whether the permission is direct or inherited via a role
Actions	Grant / Revoke buttons (admin only)

Roles Tab

The Roles tab lists all roles in the selected database and their current members.

Actions available to admin users:

• Add Member — grant a user membership in a role
• Remove Member — revoke role membership

Activity Log

The Activity Log tab reads from wg_digests.dbaccess_audit_log in PostgreSQL.

Filter Options

Filter	Description
Actor	Filter by the user who performed the action
Operation	GRANT or REVOKE
Result	SUCCESS or ERROR
Date Range	Limit to a specific time window

Log Columns

Column	Description
Timestamp	When the operation was executed
Actor	displayName of the authenticated Palantiri user
Target User	PostgreSQL user or role affected
Schema	Schema the permission applies to
Operation	GRANT or REVOKE
Privilege	e.g., SELECT, INSERT, USAGE
Result	SUCCESS or ERROR with error message on failure

Supported Databases

Database	Environment
PostgreSQL Production	✓Production
PostgreSQL Development	ℹDevelopment

note

Azure SQL databases are not managed through this interface. Use Azure RBAC or SQL logins directly for SQL Server access control.