Users & Roles

Overview of ClickHouse users, roles, and their permissions. Users managed by ClickHouse (*-internal, default) and SQL console users (sql-console*) are not documented here… they are provisioned automatically. Workspace users (ws_*) are also excluded, cuz we create them ourselves.

Users

User	Purpose	Roles / Grants
`grafana`	Grafana dashboards	`grafana_readonly`, `readonly_role`
`apiv2`	API v2 service	`insertonly_role`, `readonly_role`
`ctrl`	Control plane data writer/reader (ctrl-api + ctrl-worker)	direct grants (see script)
`frontline`	Frontline service	direct grants (see script)
`vector`	Runtime logs	INSERT on `runtime_logs_raw_v1`
`eve`	Ad-hoc analytics exploration (human)	direct grants (see script)
`github`	GitHub integrations	`readonly_role`
`vercel_dashboard`	Vercel dashboard	`readonly_role`
`unkey_admin`	Admin access	all roles

Roles

Role	Purpose
`readonly_role`	`SELECT` on `default.*`
`insertonly_role`	`INSERT` on `default.*`
`grafana_readonly`	Column-level `SELECT` on `system.*` tables

Infra

Runbooks

ClickHouse

Users

Roles

​Users

​Roles

Users

Roles