docs: document Enterprise ACL inspection functions

documentation/changelog.mdx

@@ -22,6 +22,7 @@ This page tracks significant updates to the QuestDB documentation.
 - [ALTER LIVE VIEW RESUME WAL](/docs/query/sql/alter-live-view-resume-wal/) - New reference page for resuming a live view whose own WAL was suspended after an error, and how to find suspended live views through `wal_tables()`
 - [Audited views](/docs/security/audited-views/) - QuestDB Enterprise views created `WITH AUDIT` keep a best-effort audit trail of their reads in `sys.view_audit`: who read the view, when, and with which `AUDITED` parameter values, plus the [`view.audit.*` settings](/docs/configuration/audited-views/)
 - [Declared value lists](/docs/query/sql/declare/#value-lists) - `DECLARE @symbols := ('BTC-USDT', 'ETH-USDT')` names the values of an `IN` filter once, including lists of bind variables and list parameters in views
+- [Access control functions](/docs/query/functions/access-control/) - New reference page for the QuestDB Enterprise ACL table functions. `active_permissions()` and `active_grants()`, new in Enterprise 4.1.0, list the effective permissions and the direct grants of every user, group, and service account, with examples for auditing who can read a table. The page also covers `all_permissions()` and `permissions()`
 
 ### Reference
 
@@ -53,6 +54,9 @@ This page tracks significant updates to the QuestDB documentation.
 - [EMA and VWEMA](/docs/query/functions/window-functions/reference/#avg) - Corrected the frame behavior: both reject a frame clause instead of ignoring it
 - [ALTER TABLE RESUME WAL](/docs/query/sql/alter-table-resume-wal/), [Monitoring and alerting](/docs/operations/monitoring-alerting/), and [Write-ahead log](/docs/concepts/write-ahead-log/) - Suspended materialized views and live views now point to their own `RESUME WAL` commands, since `ALTER TABLE` fails on them; [`wal_tables()`](/docs/query/functions/meta/#wal_tables) now lists live views
 - [ALTER MATERIALIZED VIEW RESUME WAL](/docs/query/sql/alter-mat-view-resume-wal/) - Corrected the Enterprise permission to `RESUME WAL`
+- [Materialized views](/docs/concepts/materialized-views/#query-constraints) and [live views](/docs/query/sql/create-live-view/#query-constraints) - Documented that the Enterprise administrative functions, such as `permissions()`, `backups()`, and `reload_tls()`, are rejected in materialized and live view queries, and the error they return
+- [RBAC](/docs/security/rbac/#replicas) - Documented how a read-only replica reloads replicated access lists, and the error a statement fails with when a reload does not finish within 30 seconds
+- [Enterprise quick start](/docs/getting-started/enterprise-quick-start/) - Corrected the guidance for listing granted permissions: `all_permissions()` lists the available permissions, and `active_grants()` lists the grants
 - [Kubernetes Operator](/docs/enterprise-kubernetes-operator/releases/) - Updated for Operator 0.3.1, with upgrade notes on the removed convenience ClusterRoles and on applying the new CRDs first when `crd.enable=false`, the synced [API reference](/docs/enterprise-kubernetes-operator/reference/api/), and QuestDB Enterprise 4.0.1 as the tested image
 - [Kubernetes Operator permissions](/docs/enterprise-kubernetes-operator/installation/#operator-permissions) - Documented the cluster-wide RBAC the Operator is granted, which Secrets it reads and creates, why it never deletes a Secret, and that it has no object store or cloud permissions
 - [Kubernetes Operator backups left by departed instances](/docs/enterprise-kubernetes-operator/operations/backup-restore/#backups-left-by-departed-instances) - On Operator-managed clusters, backup prefixes of demoted or scaled-down instances are never pruned automatically. Covers when they are still needed as a seed or restore point, how to identify the safe ones to delete, and why age-based bucket lifecycle rules are risky

documentation/concepts/live-views.md

@@ -529,6 +529,11 @@ in [Base table lifecycle](#base-table-lifecycle).
 - **Deterministic queries only.** Non-deterministic functions such as `now()`,
   `sysdate()`, `systimestamp()`, and `rnd_*()` are rejected in the projection,
   the `WHERE` filter, and window-function arguments.
+- **No administrative functions.** Enterprise functions that check the
+  caller's permissions, such as `permissions()` and `backup_instance_name()`,
+  are rejected, since a live view refreshes in the background. See
+  [query constraints](/docs/query/sql/create-live-view/#query-constraints) for
+  the full list.
 - **No TTL on the view.** Live-view disk growth is unbounded in this version.
   Base-table retention does not shrink the view, because `DROP PARTITION`,
   `TRUNCATE`, and TTL eviction on the base table leave the view's rows in place.

documentation/concepts/materialized-views.md

@@ -539,6 +539,11 @@ Materialized view queries:
 - Must use `SAMPLE BY` or `GROUP BY` with a designated timestamp column
 - Must not use `FROM-TO`, `FILL`, or `ALIGN TO FIRST OBSERVATION`
 - Must not use non-deterministic functions (`now()`, `rnd_uuid4()`)
+- Must not use Enterprise administrative functions, which check the
+  permissions of the calling session and so cannot run in a background
+  refresh: `active_grants()`, `active_permissions()`, `backup_instance_name()`,
+  `backup_status()`, `backups()`, `permissions()`, `reload_tick_calendars()`,
+  and `reload_tls()`
 - Must use join conditions compatible with incremental refresh
 - When the base table uses [deduplication](/docs/concepts/deduplication/), non-aggregate
   columns must be a subset of the `DEDUP` keys

documentation/concepts/views.md

@@ -408,6 +408,11 @@ SELECT * FROM sensitive_sales; -- Access denied!
 The view's definer permissions are preserved even if the creator's account is
 later disabled or deleted.
 
+Access control functions such as `active_grants()` and `active_permissions()`
+are an exception: in a view, they check the permissions of the user who queries
+the view, not those of its definer. See
+[access control functions](/docs/query/functions/access-control/#limitations).
+
 ### No column-level permissions on views
 
 Unlike tables, views do **not** support column-level permissions. You can only

documentation/getting-started/enterprise-quick-start.md

@@ -186,7 +186,15 @@ GRANT ALL ON table2 TO user2 WITH GRANT OPTION;
 
 Permission grants can be specific and fine-tuned.
 
-List the full list of applied permissions with `all_permissions()`.
+To check the grants, query
+[`active_grants()`](/docs/query/functions/access-control/#active_grants),
+which lists the direct grants of every user, group, and service account. It is
+available since QuestDB Enterprise 4.1.0:
+
+```questdb-sql
+SELECT * FROM active_grants()
+WHERE entity_name IN ('readonly', 'user1', 'user2');
+```
 
 - For the full role-based access control docs, including group management, see
   the [RBAC operations guide](/docs/security/rbac/).