Mysql – the REFERENCES privilege is only about creating a foreign key constraint? Practical use cases

foreign keyMySQLpermissionspostgresqlreferential-integrity

Today I learned about GRANT REFERENCES. In years of SQL admin and dev work I never heard about it and never had issues with it.

quote from MySQL 5.7 Reference Manual / GRANT Syntax

REFERENCES Enable foreign key creation. Levels: Global, database,
table, column.

quote from PostgreSQL 9.6 / GRANT

REFERENCES To create a foreign key constraint, it is necessary to have
this privilege on both the referencing and referenced columns. The
privilege may be granted for all columns of a table, or just specific
columns.

is GRANT REFERENCES only about creating a foreign key constraint? In what business case does it make sense to forbid creating a foreign key constraint (but allow to create tables)? Can you give me real world examples?

Best Answer

If you have the ability to create a foreign key constraint, you are actually getting permission to check for the existence/non-existence of a certain value in a certain column (or set of columns) of a table. You may not have the privilege to SELECT the whole list of values in this column, but you can already know something about them. You could try to insert values on the referencing table. The ones that are allowed, you already know exist in the referenced table.

If you should know absolutely nothing about those values, you cannot be granted the privilege to make a foreign key constraint on the column.

Add to that the considerations pointed out by @Erwin, WRT to being able to prevent deletes from the referenced tables.