Use a Read-Only Database User

When you connect a SQL database that an agent can query, use a database user that can only read. Grant it SELECT and nothing else. This applies to:

The MariaDB toolset and the Redshift toolset
The MariaDB connector and the PostgreSQL connector

Why

The agent writes the SQL it runs. PipesHub checks each query before it runs:

A single plain read, such as SELECT, SHOW, DESCRIBE or EXPLAIN, runs.
In a toolset, any other statement waits for your approval in the chat. This includes INSERT, UPDATE, DELETE, DROP, more than one statement, and functions that act on the server. Where nobody can approve it, such as in Slack or through the API, it does not run.
In a connector, any other statement is blocked.

These checks catch most mistakes, but they cannot know every function in every database. A user that can only read is the guarantee. If the account has no write privileges, the database itself refuses any write. Each user who authenticates a toolset uses their own database account. Make each of those accounts read-only too.

Create a read-only user

Run these as an admin user. Replace the user name, <password>, database and schema with your own.

MariaDB / MySQL
PostgreSQL
Amazon Redshift

CREATE USER 'pipeshub_reader'@'%' IDENTIFIED BY '<password>';
GRANT SELECT ON my_database.* TO 'pipeshub_reader'@'%';

CREATE USER pipeshub_reader WITH PASSWORD '<password>';
GRANT CONNECT ON DATABASE my_database TO pipeshub_reader;
GRANT USAGE ON SCHEMA public TO pipeshub_reader;
GRANT SELECT ON ALL TABLES IN SCHEMA public TO pipeshub_reader;
ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON TABLES TO pipeshub_reader;

Repeat the USAGE, SELECT and ALTER DEFAULT PRIVILEGES lines for each schema. ALTER DEFAULT PRIVILEGES covers only tables that the user who runs it creates later. If another role creates your tables, such as a migration user, run it once more for each such role with FOR ROLE <role> after ALTER DEFAULT PRIVILEGES. This needs a superuser or a member of that role. Otherwise, have each of those roles run the original line itself.

CREATE USER pipeshub_reader PASSWORD '<password>';
GRANT USAGE ON SCHEMA public TO pipeshub_reader;
GRANT SELECT ON ALL TABLES IN SCHEMA public TO pipeshub_reader;
ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON TABLES TO pipeshub_reader;

Repeat the USAGE, SELECT and ALTER DEFAULT PRIVILEGES lines for each schema. ALTER DEFAULT PRIVILEGES covers only tables that the user who runs it creates later. If another user creates your tables, such as a migration user, run it once more for each such user with FOR USER <user> after ALTER DEFAULT PRIVILEGES. Only a superuser can do this. Otherwise, have each of those users run the original line itself.A Redshift password needs 8 to 64 characters, with an uppercase letter, a lowercase letter and a number.

On Redshift and on PostgreSQL 14 and earlier, every user can create tables in the public schema by default. To remove that, run REVOKE CREATE ON SCHEMA public FROM PUBLIC;. This applies to all users, so check that no other account relies on it.

Welcome To PipesHub

System Overview

Authentication

Mail Configuration

Web Search

AI Providers

Connectors

Integrations

Agents

Toolsets

MCP Server

User Management

Deployment

Developer

Additional Resources

Why

Create a read-only user

​Why

​Create a read-only user

Why

Create a read-only user