diff --git a/docs/query-workgroup/README.md b/docs/query-workgroup/README.md
index 0071e43..f838509 100644
--- a/docs/query-workgroup/README.md
+++ b/docs/query-workgroup/README.md
@@ -173,17 +173,68 @@ a role narrower than `AdministratorAccess`.
 
 ## Permissions for running a query
 
-The deploy role has no part in this one. Whoever runs the query carries it, and Athena reads the
-source data and writes the results as them, so both buckets belong here alongside the workgroup.
+The deploy role has no part in this one. Whoever runs the query carries it. Athena plans the query,
+reads the log objects and writes the answer as that caller, and the catalog and both buckets
+therefore belong here alongside the workgroup.
+
+### The four actions `ReadOnlyAccess` denies
+
+A caller already holding the AWS managed `ReadOnlyAccess` policy is four actions short of running a
+query.
+
+- `athena:StartQueryExecution` on the workgroup
+- `athena:StopQueryExecution` on the workgroup
+- `s3:PutObject` on the results bucket
+- `s3:AbortMultipartUpload` on the results bucket
+
+Measured on 2026-08-28 with `aws iam simulate-principal-policy`, against an `AWSReservedSSO_ReadOnly`
+role carrying `ReadOnlyAccess`. Every other action on this page came back `allowed`, including
+`athena:GetWorkGroup`, `athena:ListNamedQueries`, `athena:BatchGetNamedQuery`, the three Glue reads
+and the S3 reads on both buckets.
+
+Those four cannot be dropped. A query is a job somebody starts, and its answer is an object Athena
+writes under the caller's own identity. Both of those are writes, and Athena SQL has no read-only
+path. Reading a [precomputed summary](../summaries/) does, which is the read path the named commands
+use.
+
+### Granting it from CDK
+
+```typescript
+const queries = new QueryWorkgroup(this, "RainlyticsQueries");
+const table = new LogTable(this, "RainlyticsTable", { deliveries: [delivery] });
+
+queries.grantQuerying(role, table);
+```
+
+One line per identity. It attaches the Athena actions on this workgroup, the Glue reads on the
+catalog, the database and the table, the reads on the log bucket, and the reads and writes on the
+results bucket. Every ARN it names belongs to this deployment, and a bucket encrypted with a
+customer key hands out its own `kms:Decrypt` through the same call.
+
+The table is passed because a workgroup is not tied to one. Two tables queried in the same workgroup
+are two calls, and an identity that should reach only one of them gets one.
+
+Reading the summaries is a second call, covered on the [summaries](../summaries/) page:
+
+```typescript
+summaries.grantReadingSummaries(role);
+```
+
+### The same policy written out
+
+For an identity built outside CDK. This is the list `grantQuerying` attaches.
 
 ```typescript
 new PolicyStatement({
   sid: "RunningRainlyticsQueries",
   actions: [
     "athena:StartQueryExecution",
+    "athena:StopQueryExecution",
     "athena:GetQueryExecution",
     "athena:GetQueryResults",
-    "athena:StopQueryExecution",
+    "athena:GetWorkGroup",
+    "athena:ListNamedQueries",
+    "athena:BatchGetNamedQuery",
   ],
   resources: [`arn:aws:athena:${region}:${account}:workgroup/${workgroupName}`],
 });
@@ -195,12 +246,17 @@ With `glue:GetDatabase`, `glue:GetTable` and `glue:GetPartitions` on the
 `s3:ListBucket`, `s3:GetBucketLocation`, `s3:ListBucketMultipartUploads`,
 `s3:ListMultipartUploadParts` and `s3:AbortMultipartUpload`.
 
-The multipart actions earn their place. Athena uploads a large result in parts, and this is the
-list AWS documents for a query results bucket. `s3:GetObject` on results is what reads
-the answer back, which `GetQueryResults` does on the caller's behalf.
+Athena reads the workgroup's own configuration on the way to running a query in it, and refuses the
+query without `athena:GetWorkGroup`. The two named-query actions are what `rainlytics saved-query`
+runs on. Athena answers `ListNamedQueries` with ids alone, and a name is found by reading them.
+
+The multipart actions earn their place. Athena uploads a large result in parts, and this is the list
+AWS documents for a query results bucket. `s3:GetObject` on results is what reads the answer back,
+and `GetQueryResults` does that on the caller's behalf.
 
-This list comes from AWS's documentation rather than from a deploy. Nobody has yet run a Rainlytics
-query under a policy narrower than the one their SSO role already carries.
+The four in the delta above were measured. The rest of the list comes from AWS's documentation and
+from what the `rainlytics` command sends. Nobody has yet run a Rainlytics query under a policy
+narrower than the one their SSO role already carries.
 
 <!-- card
 ```typescript
diff --git a/docs/summaries/README.md b/docs/summaries/README.md
index 81c96a5..9f5e7b6 100644
--- a/docs/summaries/README.md
+++ b/docs/summaries/README.md
@@ -231,6 +231,24 @@ fresher answer.
 rainlytics pageviews --last 7d --summaries rainlytics-summaries-1a2b
 ```
 
+### What a reader has to be allowed
+
+`s3:GetObject` on the bucket's objects, and nothing else. Every key comes from the question and the
+window, and nothing lists the bucket.
+
+A caller holding the AWS managed `ReadOnlyAccess` policy reads summaries with no policy change.
+That read came back `allowed` from `aws iam simulate-principal-policy` on 2026-08-28, against an
+`AWSReservedSSO_ReadOnly` role carrying `ReadOnlyAccess`. Running a query is the other case, and
+the [query workgroup](../query-workgroup/) page has the four actions that policy denies.
+
+An identity built narrower than that takes the read from CDK:
+
+```typescript
+summaries.grantReadingSummaries(role);
+```
+
+A bucket kept under a customer key hands out its own `kms:Decrypt` through the same call.
+
 ### Which windows a range covers
 
 A range arrives from `--last` and lands wherever the clock happens to be. The windows on S3 sit on
diff --git a/src/cdk/index.ts b/src/cdk/index.ts
index f49bc31..ad5c459 100644
--- a/src/cdk/index.ts
+++ b/src/cdk/index.ts
@@ -22,6 +22,7 @@ export {
   smallestBytesScannedCutoff,
 } from "./query-cost.js";
 export { QueryWorkgroup, type QueryWorkgroupProps } from "./query-workgroup.js";
+export type { QueryResultsBucket } from "./query-results-bucket.js";
 export {
   RollupQueries,
   type RollupQueriesProps,
diff --git a/src/cdk/query-results-bucket.ts b/src/cdk/query-results-bucket.ts
index 89bcf60..f8a8db6 100644
--- a/src/cdk/query-results-bucket.ts
+++ b/src/cdk/query-results-bucket.ts
@@ -1,5 +1,6 @@
 // Where Athena puts what a query answered.
 
+import type { IKey } from "aws-cdk-lib/aws-kms";
 import {
   BlockPublicAccess,
   Bucket,
@@ -12,6 +13,23 @@ import type { Construct } from "constructs";
 import { defaultResultsRetention } from "./query-cost.js";
 import type { QueryWorkgroupProps } from "./query-workgroup.js";
 
+/**
+ * What a policy statement needs of the results bucket, which is an ARN and
+ * whatever key encrypts it.
+ *
+ * Narrower than `IBucket`, for the reason `LogDeliveryBucket` sets out. The
+ * bucket below is created with S3-managed keys and has no key to hand out.
+ * The shape carries one anyway, so a statement over a results bucket
+ * somebody else made reads the same way the log bucket's does.
+ */
+export interface QueryResultsBucket {
+  /** The bucket's ARN, which the statement is scoped to. */
+  readonly bucketArn: string;
+
+  /** The key encrypting it, where it is encrypted with one. */
+  readonly encryptionKey?: IKey | undefined;
+}
+
 /**
  * The bucket Athena writes a query's results into.
  *
diff --git a/src/cdk/query-workgroup.test.ts b/src/cdk/query-workgroup.test.ts
index 902cb82..63179b4 100644
--- a/src/cdk/query-workgroup.test.ts
+++ b/src/cdk/query-workgroup.test.ts
@@ -1,8 +1,11 @@
 import { gzipSync } from "node:zlib";
 
 import { faker } from "@faker-js/faker";
+import { Match, Template } from "aws-cdk-lib/assertions";
 import { Distribution } from "aws-cdk-lib/aws-cloudfront";
 import { HttpOrigin } from "aws-cdk-lib/aws-cloudfront-origins";
+import { Role, ServicePrincipal } from "aws-cdk-lib/aws-iam";
+import { Key } from "aws-cdk-lib/aws-kms";
 import { App, CfnOutput, Duration, Size, Stack } from "aws-cdk-lib/core";
 import { describe, expect, it } from "vitest";
 
@@ -15,7 +18,7 @@ import {
 } from "../dataset.js";
 import { partitionPrefix } from "../partitions.js";
 import { CloudFrontLogDelivery } from "./log-delivery.js";
-import { LogBucket } from "./log-bucket.js";
+import { LogBucket, type LogBucketProps } from "./log-bucket.js";
 import { LogTable } from "./log-table.js";
 import { defaultBytesScannedCutoff } from "./query-cost.js";
 import { QueryWorkgroup, type QueryWorkgroupProps } from "./query-workgroup.js";
@@ -274,6 +277,126 @@ describe("the workgroup a Rainlytics query runs in", () => {
     expect(building).toThrow(/10000000/u);
   });
 
+  describe("what an identity granted querying can reach", () => {
+    /**
+     * A whole deployment in one stack, with a role handed the grant.
+     *
+     * Synthesised rather than deployed. IAM is the part of this a simulated
+     * account cannot prove, for the reason `summary-permissions.test.ts`
+     * gives, so these cases read the policy the grant wrote.
+     */
+    const grantedTo = (
+      logEncryption: (stack: Stack) => LogBucketProps = () => ({}),
+    ): { readonly stack: Stack; readonly logBucketName: string } => {
+      const stack = new Stack(new App(), "AnalyticsStack", {
+        env: { account: "123456789012", region: "us-east-1" },
+      });
+      const logBucketName = `rainlytics-logs-${faker.string.uuid()}`;
+      const logs = new LogBucket(stack, "RainlyticsLogs", {
+        bucketName: logBucketName,
+        ...logEncryption(stack),
+      });
+      const delivery = new CloudFrontLogDelivery(stack, "RainlyticsDelivery", {
+        distributionId: "E1EXAMPLE1234",
+        logBucket: logs.bucket,
+      });
+      const logTable = new LogTable(stack, "RainlyticsTable", {
+        deliveries: [delivery],
+      });
+      const queries = new QueryWorkgroup(stack, "RainlyticsQueries", {
+        resultsBucketName: `rainlytics-results-${faker.string.uuid()}`,
+      });
+
+      queries.grantQuerying(
+        new Role(stack, "Analyst", {
+          assumedBy: new ServicePrincipal("lambda.amazonaws.com"),
+        }),
+        logTable,
+      );
+
+      return { stack, logBucketName };
+    };
+
+    /** One allow statement as CloudFormation carries it. */
+    interface WrittenStatement {
+      readonly Action: string | string[];
+      readonly Resource: unknown;
+    }
+
+    /** The statements the granted role's own policy carries. */
+    const statementsIn = (stack: Stack): readonly WrittenStatement[] => {
+      const policies = Template.fromStack(stack).findResources(
+        "AWS::IAM::Policy",
+        {
+          Properties: { Roles: [{ Ref: Match.stringLikeRegexp("^Analyst") }] },
+        },
+      ) as Record<
+        string,
+        { Properties: { PolicyDocument: { Statement: WrittenStatement[] } } }
+      >;
+
+      return Object.values(policies).flatMap(
+        (policy) => policy.Properties.PolicyDocument.Statement,
+      );
+    };
+
+    /** Every action those statements allow. */
+    const allowed = (stack: Stack): readonly string[] =>
+      statementsIn(stack).flatMap((statement) => [statement.Action].flat());
+
+    it("reaches every service one query touches", () => {
+      // Given a role a site handed the grant.
+      const { stack } = grantedTo();
+
+      // When the stack it was granted in is synthesised.
+      const actions = allowed(stack);
+
+      // Then it holds all four halves of a query. Athena starts it, Glue
+      // plans it, the log bucket answers it and the results bucket takes the
+      // answer, and Athena does the last three as the caller rather than as
+      // itself.
+      expect(actions).toContain("athena:StartQueryExecution");
+      expect(actions).toContain("glue:GetPartitions");
+      expect(actions).toContain("s3:GetObject");
+      expect(actions).toContain("s3:PutObject");
+      // And it can look up a query the site saved, which is what
+      // `rainlytics saved-query` runs.
+      expect(actions).toContain("athena:BatchGetNamedQuery");
+    });
+
+    it("names this deployment's resources and never a wildcard", () => {
+      // Given a role granted querying over one deployment.
+      const { stack } = grantedTo();
+
+      // When the resources the grant wrote are read back.
+      const resources = statementsIn(stack).map((statement) =>
+        JSON.stringify(statement.Resource),
+      );
+
+      // Then it names this workgroup, this database and this table. A grant
+      // reaching `*` would answer the case above and still be wrong, and the
+      // account holds analytics for every site the maintainer runs.
+      expect(resources.join(",")).toContain("workgroup/rainlytics");
+      expect(resources.join(",")).toContain("table/rainlytics/cloudfront_logs");
+      expect(resources.filter((each) => each.includes('"*"'))).toStrictEqual(
+        [],
+      );
+    });
+
+    it("decrypts a log bucket a site keeps under its own key", () => {
+      // Given a deployment whose logs are encrypted with a customer key
+      // rather than with S3-managed encryption.
+      const { stack } = grantedTo((inStack) => ({
+        encryptionKey: new Key(inStack, "LogKey"),
+      }));
+
+      // Then the grantee can decrypt what it reads. S3 answers a GetObject
+      // under a key the caller cannot use with an AccessDenied from KMS, and
+      // the S3 statement has nothing to say about that.
+      expect(allowed(stack)).toContain("kms:Decrypt");
+    });
+  });
+
   const table = (): string => qualifiedTableName();
 
   /**
diff --git a/src/cdk/query-workgroup.ts b/src/cdk/query-workgroup.ts
index 4f251f7..b40d1b9 100644
--- a/src/cdk/query-workgroup.ts
+++ b/src/cdk/query-workgroup.ts
@@ -1,11 +1,20 @@
 import { CfnWorkGroup } from "aws-cdk-lib/aws-athena";
+import type { IGrantable } from "aws-cdk-lib/aws-iam";
 import type { Bucket } from "aws-cdk-lib/aws-s3";
 import type { Duration, RemovalPolicy, Size } from "aws-cdk-lib/core";
 import { Construct } from "constructs";
 
 import { defaultWorkgroupName } from "../dataset.js";
+import type { LogTable } from "./log-table.js";
 import { assertUsableCutoff, defaultBytesScannedCutoff } from "./query-cost.js";
 import { queryResultsBucket } from "./query-results-bucket.js";
+import {
+  athenaStatements,
+  catalogStatements,
+  logReadStatements,
+  resultsStatements,
+  savedQueryStatements,
+} from "./summary-permissions.js";
 
 /** What a Rainlytics query workgroup can be told. */
 export interface QueryWorkgroupProps {
@@ -148,4 +157,40 @@ export class QueryWorkgroup extends Construct {
       },
     });
   }
+
+  /**
+   * Lets an identity run Rainlytics queries against one table.
+   *
+   * ```typescript
+   * queries.grantQuerying(role, table);
+   * ```
+   *
+   * Athena is only a third of it. A query is planned from the Glue catalog,
+   * reads the log objects and writes its answer to the results bucket, and
+   * all three happen as whoever started the query rather than as Athena. So
+   * this covers the workgroup, the catalog, the database, the table, the log
+   * bucket and the results bucket, and the grantee holds no permission on any
+   * resource outside this deployment.
+   *
+   * The table is passed rather than read off the workgroup because a
+   * workgroup is not tied to one. Two tables queried in one workgroup are two
+   * calls, and a grantee that should reach only one of them gets only one.
+   *
+   * Either bucket encrypted with a customer key hands out its own
+   * `kms:Decrypt` here as well.
+   *
+   * `docs/query-workgroup/` writes the same permissions out as a policy, for
+   * an identity built outside CDK.
+   */
+  grantQuerying(grantee: IGrantable, table: LogTable): void {
+    for (const statement of [
+      ...athenaStatements(this, this.workgroupName),
+      ...savedQueryStatements(this, this.workgroupName),
+      ...catalogStatements(this, table.dataset),
+      ...logReadStatements(table.logBucket, grantee),
+      ...resultsStatements(this.resultsBucket, grantee),
+    ]) {
+      grantee.grantPrincipal.addToPrincipalPolicy(statement);
+    }
+  }
 }
diff --git a/src/cdk/rollup-summaries.test.ts b/src/cdk/rollup-summaries.test.ts
index cad5ad4..730ffc5 100644
--- a/src/cdk/rollup-summaries.test.ts
+++ b/src/cdk/rollup-summaries.test.ts
@@ -3,12 +3,15 @@ import { text } from "node:stream/consumers";
 import { gzipSync } from "node:zlib";
 
 import { faker } from "@faker-js/faker";
+import { Match, Template } from "aws-cdk-lib/assertions";
 import { Distribution } from "aws-cdk-lib/aws-cloudfront";
 import { HttpOrigin } from "aws-cdk-lib/aws-cloudfront-origins";
+import { Role, ServicePrincipal } from "aws-cdk-lib/aws-iam";
+import { Key } from "aws-cdk-lib/aws-kms";
 import { RetentionDays } from "aws-cdk-lib/aws-logs";
-import { Bucket } from "aws-cdk-lib/aws-s3";
+import { Bucket, BucketEncryption } from "aws-cdk-lib/aws-s3";
 import {
-  type App,
+  App,
   CfnOutput,
   Duration,
   RemovalPolicy,
@@ -465,4 +468,104 @@ describe("computing rollup summaries on a schedule", () => {
     // Then the windows written out above are the ones a run would meet.
     expect(simStartedAt.toISOString()).toBe("2026-08-23T09:00:00.000Z");
   });
+
+  describe("what an identity granted reading summaries can reach", () => {
+    /**
+     * A deployment in one stack, with a role handed the read grant.
+     *
+     * Synthesised rather than deployed. IAM is the part of this a simulated
+     * account cannot prove, for the reason `summary-permissions.test.ts`
+     * gives, so this case reads the policy the grant wrote.
+     */
+    const grantedTo = (
+      summariesBucket: (stack: Stack) => Bucket | undefined = () => undefined,
+    ): Stack => {
+      const stack = new Stack(new App(), "AnalyticsStack", {
+        env: { account: "123456789012", region: "us-east-1" },
+      });
+      const logs = new LogBucket(stack, "RainlyticsLogs", {
+        bucketName: `rainlytics-logs-${faker.string.uuid()}`,
+      });
+      const delivery = new CloudFrontLogDelivery(stack, "Delivery", {
+        distributionId: "E1EXAMPLE1234",
+        logBucket: logs.bucket,
+      });
+      const passed = summariesBucket(stack);
+      const summaries = new RollupSummaries(stack, "RainlyticsSummaries", {
+        table: new LogTable(stack, "RainlyticsTable", {
+          deliveries: [delivery],
+        }),
+        workgroup: new QueryWorkgroup(stack, "RainlyticsQueries"),
+        rollups: [viewsOnly],
+        granularities: ["hourly"],
+        ...(passed === undefined ? {} : { summariesBucket: passed }),
+      });
+
+      summaries.grantReadingSummaries(
+        new Role(stack, "Reader", {
+          assumedBy: new ServicePrincipal("lambda.amazonaws.com"),
+        }),
+      );
+
+      return stack;
+    };
+
+    /**
+     * Every action the reader's own policy allows.
+     *
+     * The reader's alone. The stack also holds the scheduled job, whose role
+     * reads and writes far more than a reader does, and a case that gathered
+     * both would pass on the job's permissions.
+     */
+    const allowed = (stack: Stack): readonly string[] => {
+      const policies = Template.fromStack(stack).findResources(
+        "AWS::IAM::Policy",
+        { Properties: { Roles: [{ Ref: Match.stringLikeRegexp("^Reader") }] } },
+      ) as Record<
+        string,
+        {
+          Properties: {
+            PolicyDocument: { Statement: { Action: string | string[] }[] };
+          };
+        }
+      >;
+
+      return Object.values(policies).flatMap((policy) =>
+        policy.Properties.PolicyDocument.Statement.flatMap((statement) =>
+          [statement.Action].flat(),
+        ),
+      );
+    };
+
+    it("reads the objects and nothing else", () => {
+      // Given a role a site handed the read grant.
+      const stack = grantedTo();
+
+      // When the actions the grant wrote are read back.
+      const actions = allowed(stack);
+
+      // Then it can fetch a summary. Every key a reader wants is built from
+      // the question and the window, so this is the whole of the read path.
+      expect(actions).toContain("s3:GetObject");
+      // And it cannot write one. A reader that could put an object could
+      // answer a question with a figure nothing computed.
+      expect(actions).not.toContain("s3:PutObject");
+    });
+
+    it("decrypts a summaries bucket a site keeps under its own key", () => {
+      // Given a site passing a bucket encrypted with a customer key rather
+      // than letting the construct create one under S3-managed encryption.
+      const stack = grantedTo(
+        (inStack) =>
+          new Bucket(inStack, "OwnSummaries", {
+            encryption: BucketEncryption.KMS,
+            encryptionKey: new Key(inStack, "SummaryKey"),
+          }),
+      );
+
+      // Then the reader can decrypt what it reads. S3 answers a GetObject
+      // under a key the caller cannot use with an AccessDenied from KMS.
+      expect(allowed(stack)).toContain("kms:Decrypt");
+    });
+  });
 });
diff --git a/src/cdk/rollup-summaries.ts b/src/cdk/rollup-summaries.ts
index 05b893a..a59231d 100644
--- a/src/cdk/rollup-summaries.ts
+++ b/src/cdk/rollup-summaries.ts
@@ -1,3 +1,4 @@
+import type { IGrantable } from "aws-cdk-lib/aws-iam";
 import { Construct } from "constructs";
 
 import type { RollupSummariesProps } from "./summary-configuration.js";
@@ -5,6 +6,7 @@ import { summaryConfiguration } from "./summary-configuration.js";
 import type { SummariesBucket } from "./summary-bucket.js";
 import { summariesBucket } from "./summary-bucket.js";
 import { SummaryFunction } from "./summary-function.js";
+import { summaryReadStatements } from "./summary-permissions.js";
 import { summaryRuns } from "./summary-questions.js";
 import { SummarySchedules } from "./summary-schedules.js";
 import type { IFunction } from "aws-cdk-lib/aws-lambda";
@@ -87,4 +89,27 @@ export class RollupSummaries extends Construct {
       }),
     }).schedules;
   }
+
+  /**
+   * Lets an identity read the summaries this deployment writes.
+   *
+   * ```typescript
+   * summaries.grantReadingSummaries(role);
+   * ```
+   *
+   * One `s3:GetObject` on the bucket's objects, which is the whole of what
+   * `rainlytics pageviews --last 7d` and its four siblings send. A reader
+   * builds the key it wants out of the question and the window, so nothing
+   * lists the bucket.
+   *
+   * `ReadOnlyAccess` already allows that read, so an identity holding it
+   * needs no grant here. This is for one built narrower than that, and for
+   * a bucket under a customer key, whose `kms:Decrypt` is handed out here as
+   * well.
+   */
+  grantReadingSummaries(grantee: IGrantable): void {
+    for (const statement of summaryReadStatements(this.bucket, grantee)) {
+      grantee.grantPrincipal.addToPrincipalPolicy(statement);
+    }
+  }
 }
diff --git a/src/cdk/summary-bucket.ts b/src/cdk/summary-bucket.ts
index 39c335e..45a9b96 100644
--- a/src/cdk/summary-bucket.ts
+++ b/src/cdk/summary-bucket.ts
@@ -1,6 +1,7 @@
 // Where the precomputed answers live.
 
 import type { Grant, IGrantable } from "aws-cdk-lib/aws-iam";
+import type { IKey } from "aws-cdk-lib/aws-kms";
 import {
   BlockPublicAccess,
   Bucket,
@@ -11,8 +12,8 @@ import { Duration, RemovalPolicy } from "aws-cdk-lib/core";
 import type { Construct } from "constructs";
 
 /**
- * What the job needs of the bucket it writes into, which is a name and
- * permission to put an object.
+ * What the job needs of the bucket it writes into, and what a reader needs of
+ * the bucket it reads.
  *
  * Deliberately narrower than `IBucket`, for the reason `LogDeliveryBucket`
  * sets out. Under `exactOptionalPropertyTypes`, CDK's own `Bucket` is not
@@ -25,6 +26,14 @@ export interface SummariesBucket {
   /** The bucket's name, which the job is given in its environment. */
   readonly bucketName: string;
 
+  /**
+   * The bucket's ARN, which `grantReadingSummaries` scopes the read to.
+   */
+  readonly bucketArn: string;
+
+  /** The key encrypting it, where it is encrypted with one. */
+  readonly encryptionKey?: IKey | undefined;
+
   /** Letting the job put an object in it. */
   readonly grantPut: (
     grantee: IGrantable,
diff --git a/src/cdk/summary-function.ts b/src/cdk/summary-function.ts
index d0be0cc..b3b883c 100644
--- a/src/cdk/summary-function.ts
+++ b/src/cdk/summary-function.ts
@@ -24,6 +24,7 @@ import {
   athenaStatements,
   catalogStatements,
   logReadStatements,
+  resultsStatements,
   visitorSaltStatements,
 } from "./summary-permissions.js";
 
@@ -120,14 +121,14 @@ export class SummaryFunction extends Construct {
       ...athenaStatements(this, props.workgroup.workgroupName),
       ...catalogStatements(this, props.table.dataset),
       ...logReadStatements(props.table.logBucket, this.lambda),
+      // Athena writes every query's output to the workgroup's results
+      // location as the caller, and reads it back to answer GetQueryResults.
+      ...resultsStatements(props.workgroup.resultsBucket, this.lambda),
       ...visitorSaltStatements(this, saltParameter),
     ]) {
       this.lambda.addToRolePolicy(statement);
     }
 
-    // Athena writes every query's output to the workgroup's results location
-    // as the caller, and reads it back to answer GetQueryResults.
-    props.workgroup.resultsBucket.grantReadWrite(this.lambda);
     props.bucket.grantPut(this.lambda);
   }
 }
diff --git a/src/cdk/summary-permissions.test.ts b/src/cdk/summary-permissions.test.ts
index 4abf7f1..bf46220 100644
--- a/src/cdk/summary-permissions.test.ts
+++ b/src/cdk/summary-permissions.test.ts
@@ -1,3 +1,8 @@
+import { faker } from "@faker-js/faker";
+import { Template } from "aws-cdk-lib/assertions";
+import { Role, ServicePrincipal } from "aws-cdk-lib/aws-iam";
+import { Key } from "aws-cdk-lib/aws-kms";
+import { Bucket, BucketEncryption } from "aws-cdk-lib/aws-s3";
 import { Stack } from "aws-cdk-lib/core";
 import { describe, expect, it } from "vitest";
 
@@ -5,6 +10,9 @@ import { defaultLogDataset } from "../dataset.js";
 import {
   athenaStatements,
   catalogStatements,
+  resultsStatements,
+  savedQueryStatements,
+  summaryReadStatements,
   visitorSaltStatements,
 } from "./summary-permissions.js";
 
@@ -42,6 +50,50 @@ describe("what the job is allowed to reach", () => {
       env: { account: "123456789012", region: "eu-west-2" },
     });
 
+  /** The actions a statement allows, in the order they were written. */
+  const actionsOf = (
+    statements: readonly { toStatementJson: () => unknown }[],
+  ): readonly string[] =>
+    statements.flatMap((statement) => {
+      const written = statement.toStatementJson() as {
+        Action: string | string[];
+      };
+
+      return [written.Action].flat();
+    });
+
+  /** A role standing in for whatever a site hands the grant. */
+  const aReader = (stack: Stack): Role =>
+    new Role(stack, `Reader${faker.string.alphanumeric(10)}`, {
+      assumedBy: new ServicePrincipal("lambda.amazonaws.com"),
+    });
+
+  /**
+   * Every action the identity policies in a stack allow.
+   *
+   * Read off the synthesised template rather than off the statements,
+   * because a decrypt permission is handed out by the key rather than
+   * returned, and the role is where the two meet.
+   */
+  const allowedIn = (stack: Stack): readonly string[] => {
+    const policies = Template.fromStack(stack).findResources(
+      "AWS::IAM::Policy",
+    ) as Record<
+      string,
+      {
+        Properties: {
+          PolicyDocument: { Statement: { Action: string | string[] }[] };
+        };
+      }
+    >;
+
+    return Object.values(policies).flatMap((policy) =>
+      policy.Properties.PolicyDocument.Statement.flatMap((statement) =>
+        [statement.Action].flat(),
+      ),
+    );
+  };
+
   it("names the catalog, the database and the table and nothing else", () => {
     // Given a job reading the default dataset.
     const stack = inRegion();
@@ -110,4 +162,87 @@ describe("what the job is allowed to reach", () => {
       "arn:athena:eu-west-2:123456789012:workgroup/rainlytics",
     ]);
   });
+
+  it("finds a saved query in the workgroup it would run in", () => {
+    // Given a deployment holding rollups a site saved for itself.
+    const stack = inRegion();
+
+    // When the saved-query statements are written.
+    const statements = savedQueryStatements(stack, "rainlytics");
+
+    // Then both halves of the lookup are there. Athena answers
+    // ListNamedQueries with ids and nothing else, so a role holding the list
+    // without the batch read finds ids it cannot turn into a name or SQL.
+    expect(actionsOf(statements)).toStrictEqual([
+      "athena:ListNamedQueries",
+      "athena:BatchGetNamedQuery",
+    ]);
+    expect(resourcesOf(statements)).toStrictEqual([
+      "arn:athena:eu-west-2:123456789012:workgroup/rainlytics",
+    ]);
+  });
+
+  it("writes a query's answer and reads it back off the results bucket", () => {
+    // Given the bucket the workgroup sends results to.
+    const stack = inRegion();
+    const bucketName = `rainlytics-results-${faker.string.uuid()}`;
+    // Named rather than created, because a bucket a stack owns carries its
+    // ARN as an attribute of a resource that does not exist yet, and these
+    // cases are about which ARN the statement names.
+    const bucket = Bucket.fromBucketName(stack, "Results", bucketName);
+
+    // When the results statements are written for whoever runs the query.
+    const statements = resultsStatements(bucket, aReader(stack));
+    const actions = actionsOf(statements);
+
+    // Then the caller writes the object itself. Athena writes a result as
+    // whoever started the query, so a role that can start one and not put an
+    // object fails at the moment the answer is ready.
+    expect(actions).toContain("s3:PutObject");
+    // And a large answer, which Athena uploads in parts, can be finished or
+    // abandoned. Without these a small query answers and a big one does not.
+    expect(actions).toContain("s3:ListMultipartUploadParts");
+    expect(actions).toContain("s3:AbortMultipartUpload");
+    // And GetQueryResults reads the object back on the caller's behalf.
+    expect(actions).toContain("s3:GetObject");
+    expect(resourcesOf(statements)).toStrictEqual([
+      `arn:s3:::${bucketName}`,
+      `arn:s3:::${bucketName}/*`,
+    ]);
+  });
+
+  it("reads a summary object without listing the bucket it is in", () => {
+    // Given the bucket a deployment writes its summaries to.
+    const stack = inRegion();
+    const bucketName = `rainlytics-summaries-${faker.string.uuid()}`;
+    const bucket = Bucket.fromBucketName(stack, "Summaries", bucketName);
+
+    // When the summary read statements are written.
+    const statements = summaryReadStatements(bucket, aReader(stack));
+
+    // Then one action on the objects and nothing on the bucket. A reader
+    // builds every key it wants out of the question and the window, so a
+    // listing would only be a slower way to the same key.
+    expect(actionsOf(statements)).toStrictEqual(["s3:GetObject"]);
+    expect(resourcesOf(statements)).toStrictEqual([`arn:s3:::${bucketName}/*`]);
+  });
+
+  it("decrypts a summaries bucket a site keeps under its own key", () => {
+    // Given a site whose summaries bucket is encrypted with a customer key
+    // rather than with S3-managed encryption.
+    const stack = inRegion();
+    const bucket = new Bucket(stack, "Summaries", {
+      encryption: BucketEncryption.KMS,
+      encryptionKey: new Key(stack, "SummaryKey"),
+    });
+    const reader = aReader(stack);
+
+    // When a reader is given the summary read statements.
+    summaryReadStatements(bucket, reader);
+
+    // Then it can decrypt what it reads. S3 answers a GetObject under a key
+    // the caller cannot use with an AccessDenied from KMS, and the statement
+    // above has nothing to say about that.
+    expect(allowedIn(stack)).toContain("kms:Decrypt");
+  });
 });
diff --git a/src/cdk/summary-permissions.ts b/src/cdk/summary-permissions.ts
index 218497e..459b9f6 100644
--- a/src/cdk/summary-permissions.ts
+++ b/src/cdk/summary-permissions.ts
@@ -1,10 +1,16 @@
-// What the scheduled job is allowed to do.
+// What running a Rainlytics query takes, statement by statement.
 //
-// Athena runs the query and reads the objects as whoever started it, so this
-// role needs the log bucket as well as Athena itself. Written out rather than
-// taken from a managed policy, because `AmazonAthenaFullAccess` carries Glue
-// writes, workgroup administration and a handful of other services, and this
-// job reads one table and writes one prefix.
+// The scheduled job holds these, and so does any identity a site hands to
+// `QueryWorkgroup.grantQuerying`. One definition for both, because a query
+// started from a Lambda function and a query started from a terminal reach
+// the same workgroup, the same catalog and the same two buckets.
+//
+// Athena runs the query and reads the objects as whoever started it, so a
+// caller needs the log bucket and the results bucket as well as Athena
+// itself. Written out rather than taken from a managed policy, because
+// `AmazonAthenaFullAccess` carries Glue writes, workgroup administration and
+// a handful of other services, and this reads one table and writes one
+// prefix.
 
 import type { IGrantable } from "aws-cdk-lib/aws-iam";
 import { Effect, PolicyStatement } from "aws-cdk-lib/aws-iam";
@@ -13,6 +19,8 @@ import type { Construct } from "constructs";
 
 import type { LogDataset } from "../dataset.js";
 import type { LogDeliveryBucket } from "./delivery-bucket.js";
+import type { QueryResultsBucket } from "./query-results-bucket.js";
+import type { SummariesBucket } from "./summary-bucket.js";
 
 /**
  * Running one query in one workgroup, and stopping it.
@@ -47,6 +55,36 @@ export function athenaStatements(
   ];
 }
 
+/**
+ * Reading back the queries saved in one workgroup.
+ *
+ * `rainlytics saved-query` runs a rollup a site wrote for itself, and Athena
+ * offers no way to ask for a saved query by name. `ListNamedQueries` hands
+ * back ids and `BatchGetNamedQuery` turns them into names and SQL, so an
+ * identity holding one without the other finds nothing to run.
+ *
+ * The scheduled job is the exception. It is handed its SQL at deploy time
+ * and never looks a saved query up.
+ */
+export function savedQueryStatements(
+  scope: Construct,
+  workgroupName: string,
+): readonly PolicyStatement[] {
+  return [
+    new PolicyStatement({
+      effect: Effect.ALLOW,
+      actions: ["athena:ListNamedQueries", "athena:BatchGetNamedQuery"],
+      resources: [
+        Stack.of(scope).formatArn({
+          service: "athena",
+          resource: "workgroup",
+          resourceName: workgroupName,
+        }),
+      ],
+    }),
+  ];
+}
+
 /**
  * Reading the table definition out of the Data Catalog.
  *
@@ -145,3 +183,68 @@ export function logReadStatements(
     }),
   ];
 }
+
+/**
+ * Writing a query's answer and reading it back.
+ *
+ * Athena writes every result to the workgroup's results location as whoever
+ * started the query, and reads that object again to answer
+ * `GetQueryResults`. So the caller writes to this bucket rather than Athena
+ * writing on their behalf, and a role that can start a query but not put an
+ * object fails at the moment the answer is ready.
+ *
+ * The multipart actions earn their place. Athena uploads a large result in
+ * parts, so a role without them answers a small query and fails a big one.
+ *
+ * The grantee is taken as well as given a statement, for the reason
+ * {@link logReadStatements} gives.
+ */
+export function resultsStatements(
+  bucket: QueryResultsBucket,
+  grantee: IGrantable,
+): readonly PolicyStatement[] {
+  bucket.encryptionKey?.grantDecrypt(grantee);
+
+  return [
+    new PolicyStatement({
+      effect: Effect.ALLOW,
+      actions: [
+        "s3:PutObject",
+        "s3:GetObject",
+        "s3:GetBucketLocation",
+        "s3:ListBucket",
+        "s3:ListBucketMultipartUploads",
+        "s3:ListMultipartUploadParts",
+        "s3:AbortMultipartUpload",
+      ],
+      resources: [bucket.bucketArn, `${bucket.bucketArn}/*`],
+    }),
+  ];
+}
+
+/**
+ * Reading a precomputed summary.
+ *
+ * One action on the objects, and nothing on the bucket. A reader builds the
+ * key it wants from the question and the window, so nothing lists the prefix
+ * and a listing would only be a slower way to arrive at the same key.
+ *
+ * The grantee is taken as well as given a statement, for the reason
+ * {@link logReadStatements} gives. A site passing a bucket of its own under a
+ * customer key is where that matters here, since the created bucket uses
+ * S3-managed keys and has no key to grant.
+ */
+export function summaryReadStatements(
+  bucket: SummariesBucket,
+  grantee: IGrantable,
+): readonly PolicyStatement[] {
+  bucket.encryptionKey?.grantDecrypt(grantee);
+
+  return [
+    new PolicyStatement({
+      effect: Effect.ALLOW,
+      actions: ["s3:GetObject"],
+      resources: [`${bucket.bucketArn}/*`],
+    }),
+  ];
+}