[glasstiger]

Summary

Documents questdb/questdb-enterprise#1316: on QuestDB Enterprise, only the built-in admin can remove rows from sys.view_audit, the audit trail of audited views, or set its storage policy or TTL. Every other principal is refused, whatever it holds, DATABASE ADMIN and grants ON ALL TABLES included, with only the built-in admin can manage the retention, partitions and parameters of the view audit table. The message names partitions and parameters because SQUASH PARTITIONS, SET PARAM, and a storage policy without DROP LOCAL are refused too, although they remove no rows. The audited views page currently says the opposite: that removing rows is not refused, and that these statements need only their table permissions, on the table or ON ALL TABLES.

Refused statements on the trail: TRUNCATE TABLE, DROP PARTITION, SQUASH PARTITIONS, DETACH PARTITION, SET TTL, SET PARAM, SET STORAGE POLICY (any policy), and ENABLE STORAGE POLICY. SELECT, DISABLE STORAGE POLICY, DROP STORAGE POLICY, partition conversion and a plain RESUME WAL stay grantable. This breaks 4.1.0 deployments whose operators manage the trail's retention with grants, and leaves nobody able to manage it while the built-in admin is disabled (acl.admin.user.enabled=false), as the RBAC page recommends for production. That is deliberate, since the trail records administrators' reads too, so the pages document the workaround: a storage policy with a DROP LOCAL stage, set up front, keeps pruning the trail without any principal, and changing it means enabling the admin, which takes a restart.

Changes

• security/audited-views.md:
  • Retention: the built-in admin changes the policy and removes rows. A granted principal can still disable or drop the policy, but not enable it again or set another. New note for deployments with the built-in admin disabled: why nobody can change the policy then, and how to settle retention first with a DROP LOCAL stage, through view.audit.storage.policy before the server creates the table, checked with SHOW CREATE TABLE, or the built-in admin's SET STORAGE POLICY before it is disabled. Changing the policy, removing rows and repairing the table with FORCE DROP PARTITION then mean enabling the admin, which takes a restart.
  • Tamper protection: replaces "Removing rows is not refused" with the refused statements and their error, what stays grantable, that the built-in admin is refused too while it has assumed a service account, and what 4.1.0 allowed.
  • Permissions: the "Remove rows from the trail" row and the closing guidance on granting retention permissions.
• operations/upgrade.md: new Upgrading to 4.1.1 section. Lists the refused statements, a query that finds the principals that can run them on 4.1.0, and the steps for deployments with the built-in admin disabled: set a storage policy with a DROP LOCAL stage before upgrading from 4.1.0, clearing any TTL first, or set view.audit.storage.policy when upgrading from a release before 4.1.0, and enable the admin to change the policy or repair the trail afterwards.
• configuration/audited-views.md (view.audit.storage.policy), query/sql/alter-table-set-storage-policy.md (Permissions), query/sql/alter-table-set-ttl.md, security/governance.md, and security/rbac.md (Built-in admin): one or two sentences each, pointing to the new rules. configuration/audited-views.md and security/rbac.md also recommend a DROP LOCAL stage before the built-in admin is disabled, and the former to set the property on every node before the first start.
• changelog.mdx: an Updated entry for October 2026.

Verification

• Each statement in the lists was run against the Enterprise PR branch, as a user granted every listed permission ON ALL TABLES and as a DATABASE ADMIN holder: each is refused with the documented error. TRUNCATE TABLE naming the trail with another table truncates neither. DISABLE STORAGE POLICY, DROP STORAGE POLICY, CONVERT PARTITION TO PARQUET and RESUME WAL succeed, and ENABLE STORAGE POLICY is then refused. The built-in admin is refused while it has assumed a service account. The active_permissions() query in the upgrade section returns the expected holders. With the built-in admin disabled, a policy set through view.audit.storage.policy before the first start is active with its DROP LOCAL stage, and a GRANT ALL ... WITH GRANT OPTION administrator is refused SET TTL 0 HOURS and SET STORAGE POLICY, as EntViewAuditRetentionWithoutBuiltInAdminTest in questdb/questdb-enterprise#1316 checks.
• docusaurus build passes, with broken links and anchors set to fail the build.

Dependencies

Merge once the QuestDB Enterprise release that includes questdb/questdb-enterprise#1316 ships; until then, the pages describe behavior that 4.1.0 does not have.

The pages call that release 4.1.1, the version Enterprise main builds now. If it ships under another number, update the Upgrading to 4.1.1 heading, the #upgrading-to-411 link on the audited views page, and the changelog entry. Move the changelog entry if the merge lands after October 2026.

[github-actions]

🚀 Build success!

Latest successful preview: https://preview-609--questdb-documentation.netlify.app/docs/

Commit SHA: fded463

📦 Build generates a preview & updates the link on each commit.