Who may call a user-defined function?

The design argument is in What ClickHouse UDFs should be able to do. This page is only the history and status.

I asked for UDFs to carry an optional scope, a database in which they are callable without a prefix, so that grants on a database could cover its functions. Unscoped functions would stay global, so nothing existing would break. The privileges around functions today cover only creating and dropping them (CREATE FUNCTION, DROP FUNCTION), not calling them.

One maintainer replied on the day I opened it: grants for UDFs and views make little sense because ClickHouse has no object owners (definers). That is a real objection; my view is that it argues for designing the privilege model carefully, not for having none. It was the only maintainer reply. The issue carries the labels feature, comp-udf and external, has no assignee and no linked PR, and is open.

Status on 26.4: unchanged. A freshly created function is callable by anyone.

CREATE FUNCTION f AS (x) -> x * 2;
SELECT f(21);   -- 42

system.functions shows a UDF’s origin (SQLUserDefined or ExecutableUserDefined) and create_query, but no scope or access list. For how UDFs work today, see User-defined functions and executable scripts.