Parameter · Client Connection Defaults / Statement Behavior
createrole_self_grant
Sets whether a CREATEROLE user automatically grants the role to themselves, and with which options. An empty string disables automatic self grants.
- Default:
'' (empty) - Type: string
- Applies: Session (any user)
In plain words
A non-superuser with CREATEROLE can manage the roles it creates, but does not automatically use their privileges. This setting (new in PostgreSQL 16) changes that: with set and/or inherit, every new role is granted to its creator with those options.
For DBAs and operators
PostgreSQL 16 reworked CREATEROLE: a creating role receives ADMIN OPTION on the new role (so it can manage it) but neither INHERIT nor SET, so it cannot use the new role's privileges. Setting createrole_self_grant to set, inherit or 'set, inherit' makes the system also run the equivalent of GRANT new_role TO creator WITH SET/INHERIT TRUE.
inherit: the creator automatically has the new role's privileges.set: the creator canSET ROLEto it (and create objects owned by it).
It has no effect for superusers. Because of the ADMIN OPTION the creator could always run that GRANT itself; the setting just makes it automatic. Typical use: an application admin role that must also act as the roles it creates: ALTER ROLE app_admin SET createrole_self_grant = 'set, inherit'. It applies only to roles created afterwards (existing roles need explicit GRANTs). Other values fail with Unrecognized key word.
How to change it
Any user can change it for their session with SET.