Oracle

Keel connects with ODP.NET (managed) and reads inside read-only transactions.

Read-only role script

-- Run as an administrator, then use keel_reader in Keel.
CREATE USER keel_reader IDENTIFIED BY "choose-a-strong-password";
GRANT CREATE SESSION TO keel_reader;
-- 23ai: one grant per schema. Earlier releases: GRANT SELECT ON sales.<table> TO keel_reader; per table.
GRANT SELECT ANY TABLE ON SCHEMA sales TO keel_reader;
-- Optional, for usage-based inference: the shared SQL area.
GRANT SELECT ON sys.v_$sqlarea TO keel_reader;

Before you run it:

• GRANT SELECT ANY TABLE ON SCHEMA is Oracle 23ai syntax (one grant per schema). On 19c and earlier grant SELECT per table, for example with a PL/SQL loop over ALL_TABLES for the schema.
• Replace sales with each schema (Oracle user) Keel should see.
• The v_$sqlarea grant is optional (the shared SQL area, for usage-based inference) and must be run as SYS.

In Keel

Sources › Connect source › Oracle: Host, port (1521), service name, user and password; TLS over TCPS with the system trust store (no wallets yet). Then Test: Keel checks the network, authentication, metadata access, least privilege and query-log access, and warns if the principal can write.

How this script is verified

Run against Oracle Database 23ai Free: the new user passes Test connection, harvests and profiles, and is refused an INSERT and a CREATE TABLE. The optional v_$sqlarea grant needs SYS and is not run by the suite. See Connect sources.