debugging-table-access-denied

Diagnoses HogQL TableAccessDeniedError occurrences to distinguish real bugs from expected access denials.

713|118|Updated Aug 11, 2020
One-click install
npx skills add https://github.com/PostHog/posthog-foss --skill debugging-table-access-denied
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: debugging-table-access-denied
Source: https://github.com/PostHog/posthog-foss/tree/main/.agents/skills/debugging-table-access-denied
Command: npx skills add https://github.com/PostHog/posthog-foss --skill debugging-table-access-denied

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

When a TableAccessDeniedError appears in error tracking, a Slack alert, or a user report, it is unclear whether it signals a genuine bug in calling code or an expected access-control decision. This Skill provides a structured triage procedure for PostHog's HogQL table access denials.

Core Features & Use Cases

  • Error Classification: Distinguishes system-table denials from warehouse table/view denials and separates expected 4xx HTTP responses from background-context failures.
  • Context Analysis: Uses event query tags (team_id, user_id, product, celery_task_id, temporal.*) to identify which background job raised the error.
  • Root Cause Hints: Identifies known patterns such as userless Database.create_for calls failing closed, departed creators of background jobs, and genuine RBAC or entitlement rules.
  • Use Case: An engineer sees a table_access_denied issue in error tracking, checks the event tags, finds no user_id, and concludes the calling code has a bug because it created a database context without a user.

Quick Start

Ask the assistant to debug a TableAccessDeniedError from an error tracking issue and determine whether it is a real bug or expected behavior.

Frequently Asked Questions about debugging-table-access-denied

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I debug a TableAccessDeniedError in PostHog?

Start by reading posthog/hogql/ACCESS_CONTROL.md to understand how tables are removed from the HogQL schema. Then inspect the error event's query tags such as team_id, user_id, product, and celery_task_id to identify the context that raised it.

What does the HogQL table_access_denied error mean?

It means the query referenced a table that access control removed from the HogQL schema, and it proves the table exists. A nonexistent table raises an Unknown table error instead, so the two cases are distinguishable.

Why does table_access_denied appear in error tracking?

On HTTP requests it is an expected 4xx and never captured, so a captured issue means it was raised in a background context. Check the event's query tags like celery_task_id or temporal.* to find which background job triggered it.

When is a table access denial a real bug versus expected behavior?

A missing user_id usually indicates a userless Database.create_for call that fails closed, which is a bug in the calling code. A creator who left the organization is a known benign cause, while other cases reflect real RBAC or entitlement rules.

Does bypass_warehouse_access_control fix system table denials?

No, bypass_warehouse_access_control does not cover system tables. A system.* table name indicates a system-table decision, while a bare name indicates a warehouse table or view denial, and they follow different resolution paths.