restrict_nonsystem_relation_kind

Definition PG 18 manual

Set relation kinds for which access to non-system relations is prohibited. The value takes the form of a comma-separated list of relation kinds. Currently, the supported relation kinds are view and foreign-table.

How it works

restrict_nonsystem_relation_kind prohibits access to non-system relations of specified kinds. The supported kinds are view and foreign-table; PostgreSQL uses the restriction as a safety boundary for specialized sessions, not as general SQL authorization.

restrict_nonsystem_relation_kind is a USER-context setting. An authorized role can change it for a session, while ALTER ROLE or ALTER DATABASE can establish a default for future sessions.

Because session state can survive in pooled connections, role defaults, SET privilege, RESET behavior, and application checkout hooks are part of the control's effective boundary.

Operational considerations

Changing restrict_nonsystem_relation_kind in one session and assuming role defaults, database defaults, or other pooled sessions changed with it.

Granting broad SET rights to a control that can change correctness, policy enforcement, or name resolution.

Failing to reset a security-sensitive session value before a pooled connection is reused by another request.

Changing restrict_nonsystem_relation_kind globally without a rollback plan and a client or operational compatibility test.

Workload guidance

OLAP: Do not use it to sandbox arbitrary analytical users; enforce access with privileges, schemas, and row-level policies.

OLTP: Do not tune restrict_nonsystem_relation_kind as a general security policy. Leave it empty unless a PostgreSQL subsystem or tightly scoped maintenance workflow explicitly requires the restriction.

SMALL: Keep the default empty. Enabling relation-kind bans has no capacity benefit and can break ordinary queries unexpectedly.