hardening-user-privileges

Name: hardening-user-privileges
Availability: InStock
Author: CockroachDB

Audit CockroachDB users and role grants to reduce excessive privileges.

3|3|Updated Mar 11, 2026

Search Tags:#security #audit #rbac #least-privilege #cockroachdb #privileges

Ready to run

npx skills add https://github.com/cockroachdb/claude-plugin --skill hardening-user-privileges

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: hardening-user-privileges
Source: https://github.com/cockroachdb/claude-plugin/tree/main/skills/security-and-governance/hardening-user-privileges
Command: npx skills add https://github.com/cockroachdb/claude-plugin --skill hardening-user-privileges

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Hardening CockroachDB user privileges helps prevent privilege creep by auditing every user, role, and grant, then tightening access to enforce least-privilege.

Core Features & Use Cases

Audit current users and roles to identify admin and over-privileged accounts.
Create purpose-specific roles and reassign users to reduce broad admin grants.
Revoke excessive privileges with controlled rollback and safety checks for production clusters.
Suitable for security posture hardening, compliance audits, and ongoing RBAC governance.

Quick Start

Run an RBAC audit on your cluster and begin phased privilege hardening.

Frequently Asked Questions about hardening-user-privileges

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I audit CockroachDB users and roles for excessive privileges?▼

Auditing CockroachDB privileges involves inventorying existing users and role mappings to identify admin accounts, PUBLIC grants, and sensitive system privileges that violate least-privilege principles. This requires admin access to review current grants and membership.

What is the best way to implement least-privilege roles in CockroachDB?▼

Implementing least-privilege roles in CockroachDB requires creating purpose-specific roles and reassigning users to reduce broad admin grants. You then revoke excessive privileges using controlled rollback and safety checks to maintain production cluster security.

Can I revoke CockroachDB privileges safely on a production cluster?▼

Yes, you can safely revoke privileges on a production CockroachDB cluster by applying controlled rollback procedures and safety checks. This hardening process carefully removes excessive grants and admin memberships while minimizing disruption to active services.

Do I need admin access to modify CockroachDB role grants and membership?▼

Yes, modifying CockroachDB grants and role membership requires admin access. Privilege hardening requires administrative permissions to audit sensitive system privileges, revoke excessive access, and reassign users to purpose-specific least-privilege roles.

Why does privilege creep happen in CockroachDB RBAC environments?▼

Privilege creep in CockroachDB RBAC happens when users accumulate excessive grants and broad admin access over time without regular audits. Hardening prevents this by enforcing least-privilege through controlled revocation and purpose-specific role reassignment.

When do I need to harden CockroachDB user privileges for compliance?▼

You need to harden CockroachDB user privileges for compliance during security posture audits and ongoing RBAC governance. This enforces least-privilege by auditing admin users and revoking excessive system privileges to meet regulatory requirements.