Incident brief
Permission denied
A role tried to use a table it has not been granted privileges on. PostgreSQL denied the action instead of falling back to the owner's or a broader role's access.
In 10 seconds
- What
- Permission denied
- What triggers it
- Create a table as its owner, then switch to a role with no privileges granted on it.
- The fix
- GRANT the specific privilege (e.g. SELECT) on the table to the role that needs it.
- Proof
- Reproduced on PostgreSQL 16.14 → A role with no privileges on a table was rejected with SQLSTATE 42501 when it tried to SELECT from it. The table's data was confirmed unaffected afterward.
The fix
What to do right now
The immediate, application-level response to this error.
- GRANT the specific privilege (e.g. SELECT) on the table to the role that needs it.
- Grant only what's needed — column-level GRANTs are available if a role should see some columns but not others.
- Don't assume ALTER DEFAULT PRIVILEGES retroactively fixes access to existing tables — see the premium test for its actual scope.
GRANT SELECT ON vault.secrets TO analyst;Diagnose
See it live on the server
Run these against the affected instance to confirm the diagnosis before you act.
Standard triage — not specific to this error
These are canonical PostgreSQL system-catalog queries, shown as SQL to run. No sample output is attached because this is general triage, not a captured lab transcript.This SQLSTATE does not have an error-specific live snapshot yet. These are the canonical system-catalog queries you run against the affected server to see the problem in real time — standard triage, not a reproduced transcript.
What is running right now
Active backends, how long each has been running, and what it is waiting on.
SELECT pid,
state,
wait_event_type,
wait_event,
now() - query_start AS running_for,
left(query, 80) AS query
FROM pg_stat_activity
WHERE state <> 'idle'
AND pid <> pg_backend_pid()
ORDER BY running_for DESC NULLS LAST;Who is blocking whom
Turn raw blocking PIDs into the actual queries on both sides of the wait.
SELECT blocked.pid AS blocked_pid,
blocked.query AS blocked_query,
blocking.pid AS blocking_pid,
blocking.query AS blocking_query
FROM pg_stat_activity AS blocked
JOIN LATERAL unnest(pg_blocking_pids(blocked.pid)) AS b(pid) ON true
JOIN pg_stat_activity AS blocking ON blocking.pid = b.pid
WHERE cardinality(pg_blocking_pids(blocked.pid)) > 0;Locks that are still waiting
Every lock a backend has requested but not yet been granted.
SELECT l.pid,
l.locktype,
l.mode,
l.granted,
COALESCE(c.relname, l.transactionid::text) AS object
FROM pg_locks l
LEFT JOIN pg_class c ON c.oid = l.relation
WHERE NOT l.granted
ORDER BY l.pid;Why it happens
What PostgreSQL is telling you
The mechanism behind the error, grounded in the official manual — not paraphrased.
PostgreSQL 16 Documentation — §5.8 Privileges
For most kinds of objects, the initial state is that only the owner (or a superuser) can do anything with the object. To allow other roles to use it, privileges must be granted.Read the full section on postgresql.org →
The denied SELECT
analyst was created with no privileges granted on vault.secrets. Per the manual, only the owner (or a superuser) can act on a new object by default, so PostgreSQL denied the read.Confirming the data is untouched
The row inserted during setup is still there — the denied SELECT changed nothing.Reproduce & verify
A real, single-session PostgreSQL reproduction
A literal transcript of SQL run against a live PostgreSQL instance in an isolated lab — the commands below are exactly what was executed.
- 1Create a table as its owner, then switch to a role with no privileges granted on it.
- 2That role attempts to SELECT from the table.
- 3SQLSTATE 42501 is reported, naming the table.
One client: create a table and a no-privilege role, then SET ROLE and try to read it.
DROP TABLE IF EXISTS vault.secrets;
CREATE TABLE vault.secrets (id serial PRIMARY KEY, secret text);
INSERT INTO vault.secrets (secret) VALUES ('classified');
DROP ROLE IF EXISTS analyst;
CREATE ROLE analyst LOGIN;
GRANT USAGE ON SCHEMA vault TO analyst;SET ROLE analyst;
SELECT * FROM vault.secrets;
RESET ROLE;RESET ROLE;
SELECT count(*) FROM vault.secrets;What PostgreSQL actually returned
DROP TABLE
CREATE TABLE
INSERT 0 1
DROP ROLE
CREATE ROLE
GRANTSET
ERROR: permission denied for table secrets
RESETRESET
count
-------
1
(1 row)The GRANT fix was tested directly against the same role and table.
Grant SELECT on vault.secrets to analyst, then repeat the same read as that role.
Without this
Above: analyst has no privilege on vault.secrets and is denied.
With this, tested
Below: after GRANT SELECT, the same role can read the table.
What Pro unlocks here
- The exact prevention SQL — copy-paste ready
- Raw psql output captured from the Docker lab
- A senior-DBA action list to take it further
- Live monitoring queries to catch it in production
- The deeper audit: fix-that-fails counterexample, GUC before/after, server-log evidence
Related & next steps
Follow the thread
Everything this error touches — jump straight to the sibling error, term, runbook, or parameter.
Verification
- Last verified
- 2026-07-15 (Docker lab, PostgreSQL 16.14)
- Reviewed by
- Verified against PostgreSQL 16.14 in an isolated lab environment
- Audit status
- reviewed