GRANT cannot say TO ALL, but every neighbor can

In a multi-tenant setup where every agent is a ClickHouse user, I needed the “mail slot” pattern: anyone may INSERT into a table, only the owner may SELECT. That wants GRANT INSERT ON t.reg TO ALL, but GRANT reads ALL as a role name and fails with UNKNOWN_ROLE. Meanwhile CREATE ROW POLICY, CREATE SETTINGS PROFILE, CREATE QUOTA and SET DEFAULT ROLE all accept TO ALL as a live set of every user, including users created later. I asked for the same on GRANT, or, if the asymmetry is deliberate, a sentence in the docs saying so.

It is open, labelled feature, comp-rbac and external, with no comments and no pull request.

The workaround is a role the application grants to every user it creates. Its weakness is silent drift: one missed grant and the role means “everyone created before the omission”, with no error. Catching it takes an audit diffing system.users against system.role_grants.

CREATE ROLE writers;
GRANT INSERT ON t.reg TO writers;
-- in whatever creates a user:
GRANT writers TO new_user;

Reproduced on 26.4. See users, roles and settings profiles.