PostgreSQL

Keel connects with Npgsql and keeps every session read-only (default_transaction_read_only=on) with a server-side statement timeout.

Read-only role script

-- Run as an administrator, then use keel_reader in Keel.
CREATE ROLE keel_reader LOGIN PASSWORD 'choose-a-strong-password';
GRANT CONNECT ON DATABASE analytics TO keel_reader;
GRANT USAGE ON SCHEMA public TO keel_reader;
GRANT SELECT ON ALL TABLES IN SCHEMA public TO keel_reader;
ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON TABLES TO keel_reader;
-- Optional, for usage-based inference: query history from pg_stat_statements.
GRANT pg_read_all_stats TO keel_reader;

Before you run it:

• Replace analytics with your database and public with each schema Keel should see (repeat the three schema lines per schema).
• ALTER DEFAULT PRIVILEGES covers tables created later by the role that runs the script; if another role creates tables, add FOR ROLE <owner>.
• pg_read_all_stats is optional: it lets Keel read pg_stat_statements for usage-based inference. Leave it out if you prefer.

In Keel

Sources › Connect source › PostgreSQL: Host, port (5432), database, user and password. TLS is require by default. Then Test: Keel checks the network, authentication, metadata access, least privilege and query-log access, and warns if the principal can write.

How this script is verified

Run in the connector integration suite against PostgreSQL 17: the new role passes Test connection (including least privilege), harvests keys and foreign keys, profiles a table, and is refused an INSERT and a CREATE TABLE. See Connect sources.