| name | clickhouse-enterprise-rbac |
| description | Configure ClickHouse enterprise RBAC — SQL-based users, roles, row policies,
column-level grants, and quota management.
Use when setting up multi-user access control, implementing tenant isolation,
or configuring enterprise security for ClickHouse.
Trigger with "clickhouse RBAC", "clickhouse roles", "clickhouse permissions",
"clickhouse row policy", "clickhouse enterprise access", "clickhouse GRANT".
|
| allowed-tools | Read, Write |
| version | 1.7.0 |
| license | MIT |
| author | Jeremy Longshore <jeremy@intentsolutions.io> |
| tags | ["saas","database","analytics","clickhouse","olap"] |
| compatibility | Designed for Claude Code |
ClickHouse Enterprise RBAC
Overview
Implement enterprise-grade role-based access control in ClickHouse using SQL-based
user management, hierarchical roles, row-level policies, column grants, quotas, and
settings profiles. The workflow builds least-privilege access from the ground up:
create authenticated users, compose reusable roles, then narrow visibility with row
and column policies and cap resource use with quotas.
Follow the seven steps below at a high level from this file; drill into
the full implementation for every SQL statement, and
worked examples for two end-to-end scenarios plus audit queries.
Prerequisites
- ClickHouse with
access_management = 1 enabled (default in Cloud)
- Admin user with
GRANT OPTION
Instructions
The build-out is seven steps. Steps 1–3 (users, roles, row security) carry the core
skeleton here; Steps 4–7 (column grants, quotas, settings profiles, and the
application wrapper) are summarized here and fully specified in
references/implementation.md.
Step 1: Create Users with Authentication
Pick an authentication method per user: sha256_password (standard),
double_sha1_password (MySQL wire protocol), or bcrypt_password (strongest — use
for admin accounts). Restrict network reach with HOST IP and cap per-user resources
inline with SETTINGS.
CREATE USER app_backend
IDENTIFIED WITH sha256_password BY 'strong-password-here'
DEFAULT DATABASE analytics
HOST IP '10.0.0.0/8'
SETTINGS max_memory_usage = 10000000000,
max_execution_time = 60;
SHOW CREATE USER app_backend;
Step 2: Create Role Hierarchy
