Concepts

System Principals

Trigger-locked service accounts that skip prohibitions.

morbac.system_principals registers backend service accounts, such as Valmont's lab-importer job that files lab results at night. Registration has two effects:

Prohibitions are skipped entirely for the principal in is_allowed. A misconfigured ban can never stop the nightly import. Permissions are still required: a principal with no permission rule gets denied like anyone else.
Triggers freeze their configuration. No role assignments or revocations, no delegations involving them, no user rules, no targeted global prohibitions. Attempts raise an exception.

INSERT INTO morbac.system_principals (user_id, description)
VALUES ('aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa', 'Nightly lab importer');

The table has no insert/update/delete policies: only the database owner, at deploy time, can register or remove principals. That is the point: system principals are infrastructure, not data that admins edit at runtime.

See the service accounts recipe for the full pattern, including why ordinary service users usually should not be principals. The permission side of these accounts is written with global rules.

Concepts

System Principals

Trigger-locked service accounts that skip prohibitions.

morbac.system_principals registers backend service accounts, such as Valmont's lab-importer job that files lab results at night. Registration has two effects:

Prohibitions are skipped entirely for the principal in is_allowed. A misconfigured ban can never stop the nightly import. Permissions are still required: a principal with no permission rule gets denied like anyone else.
Triggers freeze their configuration. No role assignments or revocations, no delegations involving them, no user rules, no targeted global prohibitions. Attempts raise an exception.

INSERT INTO morbac.system_principals (user_id, description)
VALUES ('aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa', 'Nightly lab importer');

See the service accounts recipe for the full pattern, including why ordinary service users usually should not be principals. The permission side of these accounts is written with global rules.