diff --git a/migrations/0006_puzzle_gravity_permissions.sql b/migrations/0006_puzzle_gravity_permissions.sql
new file mode 100644
index 0000000..0f3b73d
--- /dev/null
+++ b/migrations/0006_puzzle_gravity_permissions.sql
@@ -0,0 +1,14 @@
+-- Runtime pools use least-privilege roles rather than the migration owner.
+GRANT SELECT, INSERT, UPDATE, DELETE ON TABLE
+    puzzle_content_revisions,
+    puzzle_content_blocks,
+    puzzle_content_targets,
+    puzzle_content_rules
+TO analytics_writer;
+
+GRANT SELECT ON TABLE
+    puzzle_content_revisions,
+    puzzle_content_blocks,
+    puzzle_content_targets,
+    puzzle_content_rules
+TO analytics_reader;