datastore/docker/server/datastore-iam-roles.xml

<clickhouse>
    <!--
      The roles of the Hanzo IAM directory (datastore-iam.xml) that must exist before any SQL
      runs, declared here because nothing without them could create them.

      superadmin  platform authority: a person whose home org is admin, in a token signed with
                  the admin org's key. Everything, including granting.

      schema      what a schema's owning service needs to run its own migrations, as its own IAM
                  application, with no person and no password: DDL on the event plane and the
                  attic beside it, the event plane's row policies, the four event-plane roles by
                  name, and SELECT and INSERT on event.* with grant option so it can give those
                  roles their rights. It cannot grant anything outside the event database, it
                  creates no role but the four it owns, and the directory's <grantees> limit whom
                  its grants may name to reader, writer and sink. It creates tables only with the
                  engines its migrations use (datastore-iam.xml makes table engines need a grant),
                  and no dictionaries: a dictionary's source logs in as a user of its own choosing,
                  so it would read outside the event database. The migration runner keeps its
                  ledger and lock in the schema's own database (event.migration,
                  event.migration_lock_*, cloud datastore.Migrate), so they need nothing more.

      platform    the cloud host (hanzo-cloud): the hanzo database it creates and owns (usage
                  ledgers, rollups, risk features, the audit mirror), including granting SELECT on
                  its own tables and writing their row policies, so it confines its own
                  org-keyed tables the way schema confines the event plane, with the same table
                  engines. Nothing in event.

      The event-plane roles themselves (tenant, reader, writer, sink), their grants and their row
      policies are the schema's, and hanzoai/o11y migration 0005 creates them.
    -->
    <roles>
        <superadmin>
            <grants>
                <query>GRANT ALL ON *.* WITH GRANT OPTION</query>
            </grants>
        </superadmin>

        <schema>
            <grants>
                <query>GRANT SELECT, INSERT ON event.* WITH GRANT OPTION</query>
                <query>GRANT CREATE DATABASE, CREATE TABLE, CREATE VIEW, ALTER, DROP TABLE, DROP VIEW, TRUNCATE, OPTIMIZE, SHOW ON event.*</query>
                <query>GRANT CREATE ROW POLICY, ALTER ROW POLICY, DROP ROW POLICY, SHOW ROW POLICIES ON event.*</query>
                <query>GRANT CREATE DATABASE, CREATE TABLE, ALTER, DROP TABLE, SELECT, INSERT, SHOW ON attic.*</query>
                <query>GRANT CREATE ROLE ON tenant</query>
                <query>GRANT CREATE ROLE ON reader</query>
                <query>GRANT CREATE ROLE ON writer</query>
                <query>GRANT CREATE ROLE ON sink</query>
                <query>GRANT TABLE ENGINE ON MergeTree</query>
                <query>GRANT TABLE ENGINE ON ReplacingMergeTree</query>
                <query>GRANT TABLE ENGINE ON AggregatingMergeTree</query>
                <query>GRANT TABLE ENGINE ON SummingMergeTree</query>
                <query>GRANT TABLE ENGINE ON Null</query>
                <query>GRANT SHOW ROLES ON *.*</query>
                <query>GRANT SELECT ON system.tables</query>
                <query>GRANT SELECT ON system.columns</query>
                <query>GRANT SELECT ON system.parts</query>
                <query>GRANT SELECT ON system.roles</query>
                <query>GRANT SELECT ON system.row_policies</query>
            </grants>
        </schema>

        <platform>
            <grants>
                <query>GRANT CREATE DATABASE, CREATE TABLE, CREATE VIEW, ALTER, DROP TABLE, DROP VIEW, TRUNCATE, OPTIMIZE, SHOW ON hanzo.*</query>
                <query>GRANT SELECT ON hanzo.* WITH GRANT OPTION</query>
                <query>GRANT INSERT ON hanzo.*</query>
                <query>GRANT CREATE ROW POLICY, ALTER ROW POLICY, DROP ROW POLICY, SHOW ROW POLICIES ON hanzo.*</query>
                <query>GRANT TABLE ENGINE ON MergeTree</query>
                <query>GRANT TABLE ENGINE ON ReplacingMergeTree</query>
                <query>GRANT TABLE ENGINE ON AggregatingMergeTree</query>
                <query>GRANT TABLE ENGINE ON SummingMergeTree</query>
                <query>GRANT TABLE ENGINE ON Null</query>
                <query>GRANT SELECT ON system.tables</query>
                <query>GRANT SELECT ON system.columns</query>
                <query>GRANT SELECT ON system.disks</query>
            </grants>
        </platform>
    </roles>
</clickhouse>