# postgres/grants

> Reports a migration that grants all privileges.

Reports a migration that grants all privileges.

Part of the [`postgres`](/reference/configurations/postgres/) configuration, at the `recommended` [level](/start/concepts/#levels). It runs at the `commit` [stage](/start/concepts/#stage), once per scope. gspot runs this check itself.

## Why

A full grant includes truncating the table, adding triggers, and each privilege a later Postgres adds, which nobody meant to give.

## What to do

Name the privileges the role needs, such as `SELECT` alone.

## Example

The statement `GRANT ALL ON TABLE public.items TO app_reader;` reports a broad grant. If the role only reads rows, use `GRANT SELECT ON TABLE public.items TO app_reader;`.

## Turn it off

Turn it off for some files, with a reason:

```shell
gspot ignore postgres/grants --paths "<glob>" --reason "<why>"
```