All extension tables and functions are revoked from PUBLIC. Application sessions should use separately owned roles and must not own the extension.

When these roles already exist at installation, grants are applied:

• risk_reader: audit views;
• risk_evaluator: risk_check and risk_evaluate;
• risk_operator: holds and manual overrides;
• risk_admin: subjects, immutable policy/rule creation, destinations, exposure mappings, metrics, and validation.

Writing entry points that need internal tables are SECURITY DEFINER and pin the extension schema and pg_catalog in search_path; attacker-controlled temporary schemas are excluded. Internal helpers remain unavailable to PUBLIC. Adapters make no network calls and do not mutate an integrated extension.

Hold and override actor fields must equal session_user; callers cannot write another identity into the audit trail. The admin role configures immutable policies and rules through validated APIs and has no direct write access to holds, overrides, policies, rules, or ledger-cache tables. risk_validate() is a definer entry point, so an admin can run diagnostics without gaining table access.

Treat both DENY and ERROR as externally denied. ERROR retains the distinction between policy rejection and unavailable critical safety data.