restrict_nonsystem_relation_kind

restrict_nonsystem_relation_kind is the PostgreSQL setting that prohibits access to non-system relations of specified kinds.

Note

Fact — official short description: “Prohibits access to non-system relations of specified kinds.”

Identity

Type , Valuestring: Upstream pg_settings type
Context , Valueuser: Settable by an ordinary user
Unit , Value—: Raw unit
Range , Value—: Raw limits in the last observed version
Enum values , Value—: — for non-enum types
Category , ValueClient Connection Defaults / Statement Behavior: Upstream classification
Latest boot value , Value"": empty string

Lifecycle

Fact	Value
First observed	PG12
Present in	PG12–19 Beta 3
Removed in	No
Introduction commit	`79c7a7e29695` — Restrict accesses to non-system views and foreign tables during pg_dump.
Commit date	2024-08-05
Discussion	—

Default history

Measured PG9.0–19 Beta 3 boot defaults
Versions	Raw `boot_val`	Unit	Human value
PG12–19 Beta 3	`""`	—	empty string

How it works

restrict_nonsystem_relation_kind prohibits access to non-system relations of specified kinds. The supported kinds are view and foreign-table; PostgreSQL uses the restriction as a safety boundary for specialized sessions, not as general SQL authorization.

restrict_nonsystem_relation_kind is a USER-context setting. An authorized role can change it for a session, while ALTER ROLE or ALTER DATABASE can establish a default for future sessions.

Because session state can survive in pooled connections, role defaults, SET privilege, RESET behavior, and application checkout hooks are part of the control’s effective boundary.

Tuning advice

Tip

Advice. These are workload-specific starting points and must be validated with measurements.

Workload	Guidance
OLTP	Do not tune restrict_nonsystem_relation_kind as a general security policy. Leave it empty unless a PostgreSQL subsystem or tightly scoped maintenance workflow explicitly requires the restriction.
OLAP	Do not use it to sandbox arbitrary analytical users; enforce access with privileges, schemas, and row-level policies.
Small nodes	Keep the default empty. Enabling relation-kind bans has no capacity benefit and can break ordinary queries unexpectedly.

Pigsty

Values use the fixed 8-vCPU, 32-GiB, 100-GiB SSD fixture and render the current Pigsty templates for PG19 Beta 3; this does not assert current Pigsty support for that historical or beta release.

Template	Effective value	Versus upstream boot	Source expression
OLTP	Unmodified	—	—
OLAP	Unmodified	—	—
CRIT	Unmodified	—	—
TINY	Unmodified	—	—

Caution

Advice — pending human review. Fact from the current Pigsty template projection: OLTP: PG12–19 Beta 3 unmodified; OLAP: PG12–19 Beta 3 unmodified; CRIT: PG12–19 Beta 3 unmodified; TINY: PG12–19 Beta 3 unmodified. No Pigsty-specific rationale is inferred from an absent override.

Common pitfalls

Changing restrict_nonsystem_relation_kind in one session and assuming role defaults, database defaults, or other pooled sessions changed with it.
Granting broad SET rights to a control that can change correctness, policy enforcement, or name resolution.
Failing to reset a security-sensitive session value before a pooled connection is reused by another request.
Changing restrict_nonsystem_relation_kind globally without a rollback plan and a client or operational compatibility test.

search_path · row_security · session_replication_role · event_triggers · createrole_self_grant