New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Clickhouse Enterprise Rbac

by jeremylongshore in jeremylongshore/tons-of-skills-marketplace

Configure ClickHouse enterprise RBAC — SQL-based users, roles, row policies, column-level grants, and quota management.

MITAuto-check passedBackend & APIs

Install Clickhouse Enterprise Rbac

skills CLI
$ npx skills add jeremylongshore/tons-of-skills-marketplace --skill clickhouse-enterprise-rbac -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install jeremylongshore/tons-of-skills-marketplace clickhouse-enterprise-rbac --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/jeremylongshore/tons-of-skills-marketplace.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/.curated/clickhouse-enterprise-rbac .claude/skills/clickhouse-enterprise-rbac && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
clickhouse-enterprise-rbac
GitHub stars
2.8k
Token cost
~1.6k tokens
SKILL.md length
497 words
Files
3 (incl. references)
Skills in repo
3,342
Repo updated
First seen
Licence
MIT

At a glance

Configure ClickHouse enterprise RBAC — SQL-based users, roles, row policies, column-level grants, and quota management.

  • Works in 3 steps: Create Users with Authentication → Create Role Hierarchy → Row-Level Security
  • Setting up multi-user access control
  • SKILL.md covers Overview, Prerequisites, Instructions and Output, plus 4 more sections
  • Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md

What it does

Clickhouse Enterprise Rbac is an agent skill from jeremylongshore/tons-of-skills-marketplace. Configure ClickHouse enterprise RBAC — SQL-based users, roles, row policies, column-level grants, and quota management. Use when setting up multi-user access control, implementing tenant isolation, or configuring enterprise security for ClickHouse. Trigger with "clickhouse RBAC", "clickhouse roles", "clickhouse permissions", "clickhouse row policy", "clickhouse enterprise access", "clickhouse GRANT".

Its SKILL.md is about 1.6k tokens, which your agent loads only when the skill is triggered. The skill folder holds 3 other files, including reference files (for example `references/examples.md` and `references/implementation.md`). Compatibility notes: Designed for Claude Code

It sits in Backend & APIs, covering Authorization and RBAC and Data warehousing. It works with ClickHouse and SQL. The repository describes itself as: Model-agnostic agent-skills platform with a harness-free canonical layer, verified adapters, and the ccpi package manager. Explore at tonsofskills.com. The licence is MIT.

When your agent uses it

  • Setting up multi-user access control
  • Implementing tenant isolation
  • Configuring enterprise security for ClickHouse
  • With clickhouse RBAC

Example prompts

  • “clickhouse RBAC”
  • “clickhouse roles”
  • “clickhouse permissions”
  • “/clickhouse-enterprise-rbac”

Requirements

  • Compatibility (from SKILL.md): Designed for Claude Code
  • Pre-approved tools (allowed-tools): Read, Write

Workflow steps

3 steps, taken from the step headings in SKILL.md.

  1. Create Users with Authentication
  2. Create Role Hierarchy
  3. Row-Level Security

What it can do on your machine

Read from SKILL.md and the folder at commit cfae287. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves these tools, so the agent can use them without asking each time:

    • Read
    • Write

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    No scripts in the folder and no shell commands in SKILL.md (its code samples are sql).

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    Links to these hosts (documentation or services it may open):

    • clickhouse.com

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

  • Compatibility

    Designed for Claude Code

    From compatibility in the SKILL.md frontmatter.

Context cost

Clickhouse Enterprise Rbac loads about 1.6k tokens when it runs, and up to ~3.8k if it reads all its reference files. Until then it costs about 108 tokens; SKILL.md has 497 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~108
When it runs · the whole SKILL.md, loaded when a task matches
~1.6k
With references · SKILL.md plus every file in references/, read only if the agent opens them
~3.8k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from jeremylongshore/tons-of-skills-marketplace at commit cfae287, republished under its MIT licence (© jeremylongshore). 497 words, ~1,567 tokens.

Download SKILL.mdSave it as .claude/skills/clickhouse-enterprise-rbac/SKILL.md (or your agent's skills folder). This skill also uses 2 other files; get the full folder from GitHub.
name
clickhouse-enterprise-rbac
description
Configure ClickHouse enterprise RBAC — SQL-based users, roles, row policies, column-level grants, and quota management. Use when setting up multi-user access control, implementing tenant isolation, or configuring enterprise security for ClickHouse. Trigger with "clickhouse RBAC", "clickhouse roles", "clickhouse permissions", "clickhouse row policy", "clickhouse enterprise access", "clickhouse GRANT".
allowed-tools
Read, Write
compatibility
Designed for Claude Code
version
1.7.0
license
MIT
author
Jeremy Longshore <jeremy@intentsolutions.io>
tags
saas, database, analytics, clickhouse, olap

ClickHouse Enterprise RBAC

Overview

Implement enterprise-grade role-based access control in ClickHouse using SQL-based user management, hierarchical roles, row-level policies, column grants, quotas, and settings profiles. The workflow builds least-privilege access from the ground up: create authenticated users, compose reusable roles, then narrow visibility with row and column policies and cap resource use with quotas.

Follow the seven steps below at a high level from this file; drill into the full implementation for every SQL statement, and worked examples for two end-to-end scenarios plus audit queries.

Prerequisites

  • ClickHouse with access_management = 1 enabled (default in Cloud)
  • Admin user with GRANT OPTION

Instructions

The build-out is seven steps. Steps 1–3 (users, roles, row security) carry the core skeleton here; Steps 4–7 (column grants, quotas, settings profiles, and the application wrapper) are summarized here and fully specified in references/implementation.md.

Step 1: Create Users with Authentication

Pick an authentication method per user: sha256_password (standard), double_sha1_password (MySQL wire protocol), or bcrypt_password (strongest — use for admin accounts). Restrict network reach with HOST IP and cap per-user resources inline with SETTINGS.

sql
CREATE USER app_backend
    IDENTIFIED WITH sha256_password BY 'strong-password-here'
    DEFAULT DATABASE analytics
    HOST IP '10.0.0.0/8'           -- Restrict to VPC
    SETTINGS max_memory_usage = 10000000000,   -- 10GB per query
             max_execution_time = 60;          -- 60s timeout

SHOW CREATE USER app_backend;      -- Verify
Step 2: Create Role Hierarchy

Build leaf-level base roles (data_reader, data_writer, schema_manager), then compose them into job roles (analyst, developer, platform_admin). Grant roles to users and set a default role that activates on connect.

sql
CREATE ROLE data_reader;
GRANT SELECT ON analytics.* TO data_reader;

CREATE ROLE analyst;
GRANT data_reader TO analyst;      -- Composite inherits base

GRANT analyst TO app_backend;
SET DEFAULT ROLE analyst TO app_backend;
SHOW GRANTS FOR app_backend;       -- Verify the full chain
Step 3: Row-Level Security

Isolate multi-tenant data with row policies — each user sees only rows matching its USING predicate. A permissive USING 1 = 1 policy lets an admin role see everything.

sql
CREATE ROW POLICY acme_isolation ON analytics.events
    FOR SELECT
    USING tenant_id = 1
    TO tenant_acme;

SELECT * FROM system.row_policies;  -- List all policies
Steps 4–7: Column Grants, Quotas, Profiles, App Wrapper
  • Step 4 — Column-level grants: GRANT SELECT(col, ...) to hide PII columns and GRANT INSERT(col, ...) to prevent metadata injection.
  • Step 5 — Quotas: cap queries, read_rows, result_rows, and execution_time per interval so one user cannot exhaust the cluster.
  • Step 6 — Settings profiles: enforce readonly, memory, thread, and concurrency ceilings; a separate ETL profile enables async_insert.
  • Step 7 — Application wrapper: a per-role client factory in the app layer so read, write, and admin operations use distinct ClickHouse users.

Full SQL and the TypeScript wrapper: references/implementation.md.

Show full SKILL.md (170 more words)Show less

Output

Running this workflow produces, in the target ClickHouse instance:

  • Users with scoped authentication, network restrictions, and per-user resource caps.
  • A role hierarchy — base roles composed into job roles, assigned as default roles.
  • Row policies enforcing tenant/row isolation, visible in system.row_policies.
  • Column grants hiding PII, verifiable via SHOW GRANTS FOR <role>.
  • Quotas and settings profiles bounding resource use per user/role.

Verify the deployment with SHOW ACCESS, SHOW GRANTS FOR <user>, and the audit queries in references/examples.md.

Error Handling

Error CodeNameSolution
497ACCESS_DENIEDSHOW GRANTS FOR user, add missing GRANT
516AUTHENTICATION_FAILEDVerify password, check HOST restriction
164READONLYUser has readonly=1, grant write if needed
497Not enough privileges to execute GRANTUse admin user with GRANT OPTION

Examples

Two end-to-end scenarios — a multi-tenant SaaS isolation setup and a PII-safe analyst role — plus the access-control audit queries live in references/examples.md. The core of Example 1:

sql
-- Each tenant reads only its own rows from a shared table
CREATE ROW POLICY acme_isolation   ON analytics.events FOR SELECT USING tenant_id = 1 TO tenant_acme;
CREATE ROW POLICY globex_isolation ON analytics.events FOR SELECT USING tenant_id = 2 TO tenant_globex;
-- Connected as tenant_acme, this returns ONLY tenant_id = 1:
SELECT tenant_id, count() FROM analytics.events GROUP BY tenant_id;

Resources

Next Steps

For schema migrations, see the clickhouse-migration-deep-dive skill in this pack.

© jeremylongshore, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 2 other files (references) in skills/.curated/clickhouse-enterprise-rbac of jeremylongshore/tons-of-skills-marketplace.

  • SKILL.md
  • references/examples.md
  • references/implementation.md

Open the folder on GitHubat commit cfae287

Compare with similar skills

Clickhouse Enterprise Rbac next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Clickhouse Enterprise Rbac compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Clickhouse Enterprise Rbac this skilljeremylongshore/tons-of-skills-marketplace2.8k—~1.6kAutomated safety check: PassMIT
Clickhouse Logs Queriessupabase/supabase111k—~2.4kAutomated safety check: PassApache-2.0
Chdb SQLvemetric/vemetric3951 repos~1.2kAutomated safety check: PassApache-2.0
BisectClickHouse/ClickHouse50k—~1.4kAutomated safety check: PassApache-2.0
Clickhouse System QueriesFrankChen021/datastoria327—~731Automated safety check: PassCustom licence
Webapp Buildersidequery/sidemantic129—~5.5kAutomated safety check: PassAGPL-3.0

Similar skills

  • Clickhouse Logs Queries

    supabase/supabase

    Official

    Write, review, and migrate Supabase logs queries against the ClickHouse-backed logs table (the logs.all.otel analytics endpoint).

    111k GitHub stars~2.4k tokensUpdated yesterday
    DatabasesAuto-check passed

  • Chdb SQL

    vemetric/vemetric

    A skill your agent uses when the user wants to run SQL — especially analytical SQL — on local files (parquet/csv/json), URLs, S3 paths, or remote databases (Postgres, MySQL, MongoDB, ClickHouse…

    395 GitHub starsUsed in 1 repo~1.2k tokens
    DatabasesAuto-check passed

  • Bisect

    ClickHouse/ClickHouse

    Bisect a ClickHouse regression using pre-built master binaries from CI.

    50k GitHub stars~1.4k tokensUpdated today
    DatabasesAuto-check passed

  • Clickhouse System Queries

    FrankChen021/datastoria

    Query ClickHouse system tables to inspect query logs, monitor cluster health, check replication status, and analyze slow queries.

    327 GitHub stars~731 tokensUpdated 2 mo ago
    DatabasesAuto-check passed

  • Webapp Builder

    sidequery/sidemantic

    Build interactive analytics webapps, demos, dashboards, or embedded app surfaces from Sidemantic semantic models using copyable component primitives and deterministic query inspection.

    129 GitHub stars~5.5k tokensUpdated 4 days ago
    DatabasesAuto-check passed

  • Cpu Profile

    ClickHouse/ClickHouse

    Profile a ClickHouse query using the sampling query profiler and system.tracelog.

    50k GitHub stars~1.9k tokensUpdated today
    DatabasesAuto-check: notes

More from jeremylongshore/tons-of-skills-marketplace

All 3,342 skills in this repo

  • Performing Security Code Review

    jeremylongshore/tons-of-skills-marketplace

    Execute this skill enables AI assistant to conduct a security-focused code review using the security-agent plugin.

    2.8k GitHub starsUsed in 2 repos~1.3k tokens
    Auto-check: notes

  • Adapting Transfer Learning Models

    jeremylongshore/tons-of-skills-marketplace

    Build this skill automates the adaptation of pre-trained machine learning models using transfer learning techniques.

    2.8k GitHub stars~1.1k tokensUpdated today
    Auto-check passed

  • Agent Context Loader

    jeremylongshore/tons-of-skills-marketplace

    Execute proactive auto-loading: automatically detects and loads agents.md files.

    2.8k GitHub stars~1.1k tokensUpdated today
    Auto-check passed

  • Aggregating Performance Metrics

    jeremylongshore/tons-of-skills-marketplace

    Aggregate and centralize performance metrics from applications, systems, databases, caches, and services.

    2.8k GitHub stars~1.2k tokensUpdated today
    Auto-check passed

  • Analyzing Capacity Planning

    jeremylongshore/tons-of-skills-marketplace

    Execute this skill enables AI assistant to analyze capacity requirements and plan for future growth.

    2.8k GitHub stars~947 tokensUpdated today
    Auto-check passed

  • Analyzing Database Indexes

    jeremylongshore/tons-of-skills-marketplace

    Process use when you need to work with database indexing. An agent skill from jeremylongshore/tons-of-skills-marketplace.

    2.8k GitHub stars~2k tokensUpdated today
    Auto-check passed

Works with

Categories

Questions about Clickhouse Enterprise Rbac

What does Clickhouse Enterprise Rbac do?

Configure ClickHouse enterprise RBAC — SQL-based users, roles, row policies, column-level grants, and quota management. Clickhouse Enterprise Rbac is an agent skill from jeremylongshore/tons-of-skills-marketplace. Configure ClickHouse enterprise RBAC — SQL-based users, roles, row policies, column-level grants, and quota management.

When should I use Clickhouse Enterprise Rbac?

Clickhouse Enterprise Rbac fits situations like: setting up multi-user access control; implementing tenant isolation; configuring enterprise security for ClickHouse; with clickhouse RBAC.

How do I install Clickhouse Enterprise Rbac in Claude Code?

Run `npx skills add jeremylongshore/tons-of-skills-marketplace --skill clickhouse-enterprise-rbac -a claude-code`. Or copy the skill folder (skills/.curated/clickhouse-enterprise-rbac in jeremylongshore/tons-of-skills-marketplace) into .claude/skills/clickhouse-enterprise-rbac in your project. Claude Code loads it when a task matches its description.

How do I install Clickhouse Enterprise Rbac in Codex?

Run `npx skills add jeremylongshore/tons-of-skills-marketplace --skill clickhouse-enterprise-rbac -a codex`. Or copy the skill folder (skills/.curated/clickhouse-enterprise-rbac in jeremylongshore/tons-of-skills-marketplace) into .agents/skills/clickhouse-enterprise-rbac in your project. Codex loads it when a task matches its description.

Can I use Clickhouse Enterprise Rbac in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add jeremylongshore/tons-of-skills-marketplace --skill clickhouse-enterprise-rbac -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/clickhouse-enterprise-rbac, .gemini/skills/clickhouse-enterprise-rbac, .github/skills/clickhouse-enterprise-rbac and .opencode/skills/clickhouse-enterprise-rbac in your project.

What does Clickhouse Enterprise Rbac need to run?

SKILL.md names no scripts, command-line tools or credentials: Clickhouse Enterprise Rbac is instructions for the agent only. Its frontmatter pre-approves these tools: Read, Write. Compatibility (from SKILL.md): Designed for Claude Code.

Does Clickhouse Enterprise Rbac access the network?

SKILL.md names 1 domain. As links in the text: clickhouse.com. This is read from the text; nothing was executed.

Is Clickhouse Enterprise Rbac safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Clickhouse Enterprise Rbac use?

Clickhouse Enterprise Rbac is published under the MIT licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Clickhouse Enterprise Rbac use?

About 1.6k tokens (SKILL.md is roughly 6.3k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 2.2k tokens, read only when the agent opens those files.

What are the alternatives to Clickhouse Enterprise Rbac?

Skills that share tags, products or a category with Clickhouse Enterprise Rbac: Clickhouse Logs Queries (supabase/supabase, 111k stars), Chdb SQL (vemetric/vemetric, 395 stars), Bisect (ClickHouse/ClickHouse, 50k stars) and Clickhouse System Queries (FrankChen021/datastoria, 327 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Clickhouse Enterprise Rbac?

jeremylongshore (a GitHub user) maintains it in jeremylongshore/tons-of-skills-marketplace, which has 2,827 GitHub stars. The repository holds 3,342 skills in this directory. The repository was last updated on October 10, 2026.

Source: jeremylongshore/tons-of-skills-marketplace on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.