Transactional outbox delivery
Scope the publisher to the events it must deliver
The outbox worker needs access to event records and approved destinations. It does not automatically need unrestricted access to the source application's data.
In this article
Define the publisher's job
The worker reads committed event payloads, sends them to configured destinations and updates delivery state. Use that responsibility to choose its database and broker permissions.
Avoid giving it the application's administrator role simply because the outbox shares a database. Where the platform supports it, grant only the tables and operations required for claiming and recording publication.
Keep destination selection in trusted configuration or a constrained event contract. An arbitrary URL inside a business payload should not turn the publisher into a general data-export service.
Minimise the event payload
Include fields needed by consumers and avoid serialising the entire source entity by default. An order event may need an order identifier and selected state, not every customer note or internal attribute.
Remember that an event can be copied into brokers, dead-letter stores, traces and replay archives. Its retention and access surface may be broader than the original database row.
Version the payload deliberately so minimisation changes do not silently break consumers. Removing a field can be correct, but it still needs a compatibility plan.
Review operational access
Operators may need to inspect event status without reading sensitive payload contents. Provide a diagnostic view using identifiers, type, age and error category, with controlled access to content when required.
Replay permissions deserve separate attention. A person able to resend events can trigger downstream effects even if they cannot directly call the business API.
Record replay actor, reason and scope. Preserve event identity and apply the supported recovery process rather than allowing unrestricted payload edits.
Test the actual identities
Use the deployed publisher role to confirm it can read and update the required outbox records while being denied unrelated mutations where that is the intended boundary. Test broker permissions against approved and unapproved destinations.
Inspect failed-message storage and logs for unnecessary content copies. Apply retention and access rules consistent with the payload's classification.
The review should show that the publisher can fulfil its delivery responsibility without inheriting broader application authority. Shared infrastructure is compatible with narrow permissions only when those permissions are deliberately configured and verified.
Primary sources
PostgreSQL: privilegesOWASP: logging guidanceReferences checked 11 September 2026.