Schema Access

Schema Access decides which PostgreSQL schemas an organization may use. It is the coarsest of the three access controls in v2.0.0 and it sits above the other two: an organization that has not been granted a schema sees nothing in it, regardless of role capabilities and regardless of what the RLS policy would have allowed.

Sidebar location: Access Control → Advanced (System admin) → Schema Access. This page is System Administrator only (system admin visibility). An Organization Administrator cannot grant their own organization a schema — by design, since doing so would let a tenant widen its own boundary.

Info

Schema Access is new in v2.0.0. It grants PostgreSQL schemas to organizations. The database column t_module.schema_name still uses the older “module” identifier; the UI and these docs say Schema.

In CYPEX, “Module” and “Schema” both name a PostgreSQL schema: a namespace grouping tables, views, and functions. The synonym is intentional and unavoidable — the UI and these docs say Schema, while database identifiers (t_module, t_module_organization, module_id) still say module. When you read module in SQL, read “schema”.

All three must permit an operation. Schema Access is checked first in practice because a missing grant produces the most confusing symptom: a correctly configured user, with correct capabilities, on a correctly policed table, who sees nothing at all and gets no error.

Warning

When a correctly configured user lands on an empty screen, check Schema Access before anything else. A missing grant returns no rows and raises no error, so nothing else in the stack reports a problem.

• Heading — Schema Access, with a short subtitle and Learn how it works.
• Organization filter — pick a tenant before toggling access. Until one is selected: Select an organization to enable or disable schema access.
• Chips — Total Schemas: N, and Enabled: N once an organization is selected.
• Table columns — Schema, Language, Security Label, Enabled. With no organization selected, Enabled shows how many organizations already have the schema (for example in 8 orgs). With an organization selected, Enabled is a per-row switch.
• Empty system — if no schemas exist at all: No Schemas Available / No database schemas are available in the system.

• Grants are additive. Enabling a second schema does not drop the first.
• Toggles apply immediately — there is no separate Save action on this page. Enable or disable one schema at a time with the Enabled switch.
• Removing a schema from one organization does not affect any other organization holding the same schema.
• Each organization has exactly one primary schema, provisioned when the organization is created. The primary determines where that organization’s generated objects land.
• Internal CYPEX schemas are excluded and are not assignable.

1. Open Access Control → Schema Access as a System Administrator.
2. Select the organization in the filter.
3. Toggle Enabled for each schema that organization needs. Existing grants stay on until you turn them off.
4. Verify with Access Preview — select a role scoped to that organization and confirm the expected queries appear.

Info

The in-product Setup Guide marks Schema Access complete automatically once a schema exists in the platform and an organization exists — which is true almost immediately, since creating an organization already provisions its primary schema. There is no confirmation action to click on this page.

Full operator procedure, with screenshots: Organizations setup guide.

The mapping lives in cypex.t_module_organization:

1
2
3
4
5
6
7
8

SELECT o.organization_domain,
       m.module_name,
       m.schema_name,
       mo.is_primary
FROM cypex.t_organization o
LEFT JOIN cypex.t_module_organization mo ON mo.organization_id = o.id
LEFT JOIN cypex.t_module m               ON m.id = mo.module_id
ORDER BY o.organization_domain, m.module_name;

An organization returning a row with module_name IS NULL has no schema access and cannot serve any data.

After an upgrade from v1.9.x, expect the Default Organization to be mapped to every pre-existing module plus the cypex_default virtual module, which is its primary. See Upgrade to v2.0.0.

• Organizations — the tenant this grant applies to.
• Capabilities vs Data Scope — the mental model.
• Access Preview — verify the result before deployment.
• Organizations setup guide — the full operator procedure.
• Glossary — the one-line Schema definition and the Module → Schema note.