Grant and authentication errors

Finds which privilege a blocked operation is missing and computes the smallest grant that unblocks it, from system.errors, system.query_log, system.grants and system.role_grants. Run altinity-expert-clickhouse-connection first if the connection mode, cluster and time window are not yet established.

Query packs

• checks.sql — 4 checks: access and authentication errors in system.errors over 24 hours (grants-01), missing privileges from queries that failed with exception code 497 (grants-02), current grants for the affected users (grants-03), roles assigned to the affected users (grants-04).
• reference.md — background (privilege families, access_control_improvements defaults); read only when you need to explain a recommendation.

How to run the query packs

1. Read each pack file from this skill's directory (the skill loader prints the directory path).
2. Run statements one at a time, never a whole file. Statements end with ; and start with a -- @check <id> <title> header; keep the id with its result.
3. Honor -- @requires: skip the statement when the named table is missing, when keeper is required and the server has no Keeper/ZooKeeper, or when the version condition is not met. List skipped ids with the reason.
4. Keep {cluster} as written when a cluster macro exists; otherwise apply the connection skill's rewrite rule. Any other {placeholder} is a template variable: substitute a real value first or skip the statement.
5. On an error, record the check id and the first line of the error, then continue. Only for UNKNOWN_IDENTIFIER, run DESCRIBE TABLE system.<table> and drop the missing column.
6. A severity column is the verdict for that row. Copy it; do not re-grade.