insufficient_privilege permission denied to create role — 42501

Symptoms

A role attempted CREATE ROLE/CREATE USER without the CREATEROLE privilege. PostgreSQL raises SQLSTATE 42501 (insufficient_privilege).

• The role lacks CREATEROLE (and is not a superuser).
• Common for least-privilege application roles.
• Role administration is a privileged operation.

What the server log shows

ERROR:  permission denied to create role

Why PostgreSQL raises this — what the manual says

Section 21.2 Role Attributes:

“A role must be explicitly given permission to create more roles (except for superusers, since those bypass all permission checks).”

Creating roles requires the CREATEROLE attribute or superuser status. Without it, PostgreSQL blocks the command with 42501.

Common causes

• The current role does not have CREATEROLE.
• Provisioning users from a least-privilege account.
• Expecting superuser behaviour from an ordinary role.

How to fix it

1. Grant the attribute: ALTER ROLE admin CREATEROLE; (by a superuser).
2. Run role management as a role with CREATEROLE or superuser.
3. Delegate role creation to an appropriate admin account.

Related & next steps

• SQLSTATE 42501 — Insufficient Privilege (full reference)
• Message: permission denied to set role
• Glossary: Role

Reference: PostgreSQL 18 Section 22.2 “Role Attributes”.