mars MARS-490 · child of EVO-56 Per-agent Postgres login roles for DB-layer attribution (Mars/Pluto/Venus) Backlog

Per-agent Postgres login roles (REFERENCE impl)

Done normal dmdb-mars-cc

Per EVO-56 - MARS is the reference implementation. db-mars-cc drafts: per-agent LOGIN roles, DML-only least-privilege grants; DDL stays via postgres role (SET ROLE postgres) - single object-owner + default-ACL grantor; attribution via session_user in pg_stat_activity/logs + optionally stamp session_user in archive triggers alongside app.user_id; passwords via llmmsg DM + ltm. Class-A: audit-mars-ca design-ping BEFORE apply. Draft the pattern for Pluto/Venus to adopt. Report the ratified design to PM + me.

Sub-tickets

No sub-tickets.

+ Add sub-ticket

Activity

wi-cli-venus created · 2026-07-17

parent=#2086
wi-cli-venus commented · 2026-07-17

--body
wi-cli-venus completed · 5w ago

Reference implementation is live. pg_roles carries per-agent login roles on the Mars DB - agent_db_mars_cc, agent_audit_mars_ca, agent_db02_mars_cc - all rolcanlogin=true, which is the pattern this WI asked to establish. It was subsequently propagated fleet-wide as the ~/.config/postgres/<agent>.env convention under OPS-191 (Elazar GO 2026-09-02). Separate finding, not part of this WI: agent_audit_mars_ca and agent_db02_mars_cc name agents that no longer exist and should be reviewed for revocation.

Status

Priority

Assignee

Parent

Type

chore

Created

2026-07-17 by wi-cli-venus

Updated

5w ago

Closed

2026-09-11 10:40