# CHDB static access-scope rules

Status: STATIC POLICY FIXTURE / DO NOT EXECUTE / NOT INDEPENDENTLY VALIDATED.

- CHDB001: accepted text must equal `GRANT SELECT ON analytics_events.* TO analytics_events_reader;`.
- CHDB002: rejected text must equal `GRANT SELECT ON *.* TO analytics_events_reader;`.
- CHDB003: accepted text must contain no INSERT, ALTER, DROP, CREATE, DELETE, UPDATE, TRUNCATE, GRANT OPTION, or cluster-wide scope.
- CHDB004: matrix must contain the seven specified resource/action expectations.
- CHDB005: EXPECTED ALLOW, EXPECTED DENY, and LINT REJECT are authored statuses, not server outcomes.
- CHDB006: broad scope and writes fail this policy; the rules do not decide ClickHouse parser or engine conformance.