Agent skill · data analytics · jeremylongshore
clickhouse-enterprise-rbac
Configure ClickHouse enterprise RBAC — SQL-based users, roles, row policies, column-level grants, and quota management. Use when setting up multi-user access control, implementing tenant isolation, or configuring enterprise security for ClickHouse. Trigger with "clickhouse RBAC", "clickhouse roles", "clickhouse permissions", "clickhouse row policy", "clickhouse enterprise access", "clickhouse GRANT".
Why this skill is useful
Provides specific SQL commands and patterns for implementing role-based access control in ClickHouse that the AI wouldn't reliably generate on its own.
What it needs
About 3k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
ClickHouse Enterprise RBAC Overview Implement enterprise-grade role-based access control in ClickHouse using SQL-based user management, hierarchical roles, row-level policies, column grants, quotas, and settings profiles. The workflow builds least-privilege access from the ground up: create authenticated users, compose reusable roles, then narrow visibility with row and column policies and cap resource use with quotas. Follow the seven steps below at a high level from this file; drill into the full implementation for every SQL statement, and worked examples for two end-to-end scenarios plus audit queries. Prerequisites ClickHouse with accessmanagement = 1 enabled (default in Cloud) Admin user with GRANT OPTION Instructions The build-out is seven steps. Steps 1–3 (users, roles, row security) carry the core skeleton here; Steps 4–7 (column grants, quotas, settings profiles, and the application wrapper) are summarized here and fully specified in references/implementation.md. Step 1: Create Users with Authentication Pick an authentication method per user: sha256password (standard), doublesha1password (MySQL wire protocol), or bcryptpassword (strongest — use for admin accounts). Restrict network reach with HOST IP and cap per-user resources inline with SETTINGS. Step 2: Create Role Hierarchy Build leaf-level base roles (datareader, datawriter, schemamanager), then compose them into job roles (analyst, developer, platformadmin). Grant roles to users and set a default role that activates on connect. Step 3: Row-Level Security Isolate multi-tenant data with row policies — each user sees only rows matching its USING predicate. A permissive USING 1 = 1 policy lets an admin role see everything. Steps 4–7: Column Grants, Quotas, Profiles, App Wrapper Step 4 — Column-level grants: GRANT SELECT(col, ...) to hide PII columns and GRANT INSERT(col, ...) to prevent metadata injection. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/clickhouse-enterprise-rbac