diff --git a/apps/e2e/scripts/run-all.mjs b/apps/e2e/scripts/run-all.mjs
index 244ba96e1..3fcdc9739 100644
--- a/apps/e2e/scripts/run-all.mjs
+++ b/apps/e2e/scripts/run-all.mjs
@@ -110,6 +110,11 @@ const ALWAYS = [
     file: 'src/tests/workspaces.test.ts src/tests/workspaces-sharing-limits.test.ts',
     label: 'Workspaces: create, switch, settings, sharing limits',
   },
+  {
+    key: 'demo-role',
+    file: 'src/tests/demo-role.test.ts',
+    label: 'Published demo: Demo role and demo mode',
+  },
   {
     key: 'sql-editor',
     file: [
diff --git a/apps/e2e/src/generated/test-ids.ts b/apps/e2e/src/generated/test-ids.ts
index 0d9d9980d..f0e27f0ee 100644
--- a/apps/e2e/src/generated/test-ids.ts
+++ b/apps/e2e/src/generated/test-ids.ts
@@ -665,6 +665,14 @@ export const TestIds = {
       adminSignInSettings: 'admin-sign-in-settings',
       /** button · Copy */
       signInCopy: 'sign-in-copy',
+      /** section · Demo mode */
+      signInDemo: 'sign-in-demo',
+      /** textarea · Demo login: demo@example.com / its password */
+      signInDemoHint: 'sign-in-demo-hint',
+      /** button · Save hint */
+      signInDemoSave: 'sign-in-demo-save',
+      /** input */
+      signInDemoToggle: 'sign-in-demo-toggle',
       /** section · Email for invites and password resets */
       signInMail: 'sign-in-mail',
       /** input · Fox <fox@example.com> */
@@ -744,6 +752,10 @@ export const TestIds = {
       /** button */
       commandPaletteItem: (id: string | number) => `command-palette-item-${id}`,
     },
+    DemoBanner: {
+      /** div */
+      demoBanner: 'demo-banner',
+    },
     featureRegistry: {
       /** data · Snapshots */
       syncPaneHistoryBtn: 'sync-pane-history-btn',
@@ -895,6 +907,8 @@ export const TestIds = {
       accountVerifySubmit: 'account-verify-submit',
     },
     AuthPage: {
+      /** div */
+      authDemoHint: 'auth-demo-hint',
       /** button · Forgot password? */
       authForgotLink: 'auth-forgot-link',
       /** button · Have an invite or reset code? */
@@ -3769,6 +3783,7 @@ export type TestId =
   | 'auth-code-back'
   | 'auth-code-continue'
   | 'auth-code-form'
+  | 'auth-demo-hint'
   | 'auth-forgot-back'
   | 'auth-forgot-email'
   | 'auth-forgot-form'
@@ -4160,6 +4175,7 @@ export type TestId =
   | 'db-access-status'
   | `db-access-toggle-group-${string}`
   | 'db-access-unsupported'
+  | 'demo-banner'
   | 'deploy-cancel-btn'
   | 'deploy-confirm-btn'
   | 'deploy-confirm-dialog'
@@ -4606,6 +4622,10 @@ export type TestId =
   | 'settings-view'
   | 'settings-workspace'
   | 'sign-in-copy'
+  | 'sign-in-demo'
+  | 'sign-in-demo-hint'
+  | 'sign-in-demo-save'
+  | 'sign-in-demo-toggle'
   | 'sign-in-mail'
   | 'sign-in-mail-from'
   | 'sign-in-mail-host'
diff --git a/apps/e2e/src/helpers/accounts.ts b/apps/e2e/src/helpers/accounts.ts
index de84e15e0..73baf92c2 100644
--- a/apps/e2e/src/helpers/accounts.ts
+++ b/apps/e2e/src/helpers/accounts.ts
@@ -19,10 +19,16 @@ export interface ApiResult {
 }
 
 /** One request to `/api<path>` as the session in `cookie`. A body that is not JSON reads as null. */
-export async function apiCall(method: string, path: string, body: unknown, cookie: string): Promise<ApiResult> {
+export async function apiCall(
+  method: string,
+  path: string,
+  body: unknown,
+  cookie: string,
+  headers: Record<string, string> = {}
+): Promise<ApiResult> {
   const res = await fetch(`${API_URL}/api${path}`, {
     method,
-    headers: { ...(body !== undefined ? { 'content-type': 'application/json' } : {}), cookie },
+    headers: { ...(body !== undefined ? { 'content-type': 'application/json' } : {}), cookie, ...headers },
     ...(body !== undefined ? { body: JSON.stringify(body) } : {}),
   });
   return { status: res.status, json: await res.json().catch(() => null) };
diff --git a/apps/e2e/src/tests/demo-role.test.ts b/apps/e2e/src/tests/demo-role.test.ts
new file mode 100644
index 000000000..e7cf1ff92
--- /dev/null
+++ b/apps/e2e/src/tests/demo-role.test.ts
@@ -0,0 +1,152 @@
+/**
+ * A published demo, in a real browser against the running server.
+ *
+ * One shared login with the Demo role: a visitor reads the login off the
+ * sign-in page, sees the demo banner, and queries the sample database an
+ * admin put in its workspace. Saving anything is refused, by the server.
+ *
+ * Runs as the suites' admin plus one throwaway demo account, and turns demo
+ * mode off again at the end, since every other suite shares this install.
+ *
+ * Requires the web app + API (`npm run dev`) and a `sqlite3` CLI on PATH.
+ */
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+import { execFileSync, execSync } from 'node:child_process';
+import { mkdirSync, rmSync } from 'node:fs';
+import { join } from 'node:path';
+import { randomBytes } from 'node:crypto';
+import type { Page } from 'playwright';
+import { buildDriver, quitDriver, clickWhen, waitFor, BASE_URL } from '../helpers/driver.js';
+import { sessionCookie } from '../helpers/app-session.js';
+import { apiCall, signInAs } from '../helpers/accounts.js';
+import { saveScreenshot } from '../helpers/screenshot.js';
+import { byTestId } from '../helpers/test-ids.js';
+import { SqlEditorPage } from '../pages/SqlEditorPage.js';
+
+const RUN = Date.now().toString(36);
+// Per-run directory: the backend pools SQLite handles by file path.
+const DIR = `/tmp/foxschema-e2e-demo-${RUN}`;
+const DB = join(DIR, 'sample.db');
+const CONNECTION = `Demo sample ${RUN}`;
+const DEMO_EMAIL = `e2e-demo-${RUN}@foxschema.test`;
+const DEMO_PASSWORD = `try-fox-${randomBytes(6).toString('hex')}`;
+const HINT = `Demo login: ${DEMO_EMAIL} / ${DEMO_PASSWORD}`;
+
+let admin = '';
+let adminId = '';
+let demoId = '';
+let demoWorkspace = '';
+let demoCookie = '';
+const pages: Page[] = [];
+
+function hasSqlite3(): boolean {
+  try {
+    execSync('which sqlite3', { stdio: 'ignore' });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+const api = (method: string, path: string, body?: unknown, cookie = admin, headers: Record<string, string> = {}) =>
+  apiCall(method, path, body, cookie, headers);
+
+describe.skipIf(!hasSqlite3())('a published demo', () => {
+  beforeAll(async () => {
+    rmSync(DIR, { recursive: true, force: true });
+    mkdirSync(DIR, { recursive: true });
+    execFileSync('sqlite3', [DB], {
+      input: `CREATE TABLE planets (id INTEGER PRIMARY KEY, name TEXT NOT NULL);
+              INSERT INTO planets VALUES (1, 'Mercury'), (2, 'Venus'), (3, 'Earth');`,
+    });
+
+    admin = await sessionCookie();
+    adminId = (await api('GET', '/auth/me')).json.user.id;
+    const made = await api('POST', '/admin/users', { email: DEMO_EMAIL, password: DEMO_PASSWORD, role: 'demo' });
+    expect(made.status, JSON.stringify(made.json)).toBe(200);
+    demoId = made.json.user.id;
+
+    // The demo cannot add connections: an admin joins its workspace, adds the
+    // sample database, and leaves — the path docs/DEPLOYMENT.md describes.
+    demoCookie = await signInAs(DEMO_EMAIL, DEMO_PASSWORD);
+    demoWorkspace = (await api('GET', '/workspaces', undefined, demoCookie)).json.currentId;
+    expect((await api('PUT', `/workspaces/${demoWorkspace}/members/${adminId}`, { role: 'owner' })).status).toBe(200);
+    const saved = await api(
+      'POST',
+      '/connections',
+      { name: CONNECTION, dialect: 'sqlite', option: { database: DB } },
+      admin,
+      { 'x-fox-workspace': demoWorkspace }
+    );
+    expect(saved.status, JSON.stringify(saved.json)).toBe(200);
+    expect((await api('DELETE', `/workspaces/${demoWorkspace}/members/${adminId}`, {})).status).toBe(200);
+
+    expect((await api('PUT', '/admin/sign-in/demo', { on: true, hint: HINT })).status).toBe(200);
+  }, 120_000);
+
+  afterAll(async () => {
+    for (const page of pages) await quitDriver(page);
+    await api('PUT', '/admin/sign-in/demo', { on: false, hint: '' });
+    if (demoId) await api('PUT', `/admin/users/${demoId}/active`, { active: false });
+    rmSync(DIR, { recursive: true, force: true });
+  });
+
+  it('the sign-in page says it is a demo and shows the login to use', async () => {
+    const page = await buildDriver({ signedIn: false });
+    pages.push(page);
+    await page.goto(BASE_URL);
+    await waitFor(page, byTestId('auth-demo-hint'), 30_000);
+    expect(await page.locator(byTestId('auth-demo-hint')).innerText()).toContain(HINT);
+    await saveScreenshot(page, 'demo-sign-in');
+
+    // A visitor signs in with exactly what the page shows.
+    await page.fill(byTestId('auth-login-email'), DEMO_EMAIL);
+    await page.fill('#auth-password', DEMO_PASSWORD);
+    await clickWhen(page, byTestId('auth-login-submit'));
+    await page.waitForSelector(`${byTestId('onboarding-skip')}, ${byTestId('demo-banner')}`, { timeout: 30_000 });
+    const skip = page.locator(byTestId('onboarding-skip'));
+    if (await skip.count()) await skip.click();
+    await waitFor(page, byTestId('demo-banner'), 15_000);
+    expect(await page.locator(byTestId('demo-banner')).innerText()).toMatch(/Nothing here can be saved/);
+    await saveScreenshot(page, 'demo-banner');
+  }, 120_000);
+
+  it('a visitor queries the sample database the admin set up', async () => {
+    const page = pages[0]!;
+    const sql = new SqlEditorPage(page);
+    await sql.openView();
+    await sql.checkConnection(CONNECTION);
+    await sql.setSql('SELECT name FROM planets ORDER BY id;');
+    await sql.run();
+    await sql.waitForResults();
+    const text = await sql.resultsText();
+    for (const planet of ['Mercury', 'Venus', 'Earth']) expect(text).toContain(planet);
+    await saveScreenshot(page, 'demo-query');
+  }, 120_000);
+
+  it('saving anything is refused, and the profile is locked', async () => {
+    const refused = [
+      await api('POST', '/connections', { name: 'mine', dialect: 'sqlite', option: { database: '/tmp/x.db' } }, demoCookie),
+      await api('POST', '/workspaces', { name: 'mine' }, demoCookie),
+      await api('POST', '/auth/sign-out-others', {}, demoCookie),
+    ];
+    for (const r of refused) {
+      expect(r.status, JSON.stringify(r.json)).toBe(403);
+      expect(r.json.error).toMatch(/read-only demo/);
+    }
+    // A write SQL statement is refused by the permissions the Demo role lacks.
+    const conn = (await api('GET', '/connections', undefined, demoCookie)).json.connections.find(
+      (c: { name: string }) => c.name === CONNECTION
+    );
+    const write = await api('POST', '/sql/execute', { connectionId: conn.id, statements: ['DELETE FROM planets'] }, demoCookie);
+    expect(write.status, JSON.stringify(write.json)).toBe(403);
+    expect(execFileSync('sqlite3', [DB, 'SELECT COUNT(*) FROM planets'], { encoding: 'utf8' }).trim()).toBe('3');
+
+    // The browser offers no way to sign the other visitors out.
+    const page = pages[0]!;
+    await page.goto(BASE_URL);
+    await clickWhen(page, byTestId('profile-menu-trigger'));
+    await waitFor(page, byTestId('profile-sign-out'), 10_000);
+    expect(await page.locator(byTestId('profile-sign-out-others')).count()).toBe(0);
+  }, 120_000);
+});
diff --git a/apps/web/src/frontend/App.tsx b/apps/web/src/frontend/App.tsx
index f93db7069..24edcefbe 100644
--- a/apps/web/src/frontend/App.tsx
+++ b/apps/web/src/frontend/App.tsx
@@ -10,6 +10,7 @@ import { apiGetPreferences } from '@/shared/api/authApi';
 import { ToastHost } from '@/app/shell/ToastHost';
 import { AlertCircle, AlertTriangle, Loader2, X } from 'lucide-react';
 import { BackendOfflineBanner } from '@/app/shell/BackendOfflineBanner';
+import { DemoBanner } from '@/app/shell/DemoBanner';
 import { CommandPalette } from '@/app/shell/CommandPalette';
 import { WORKSPACE_VIEWS, redirectFor } from '@/app/features/featureRegistry';
 import type { ActiveView } from '@/platform/viewIds';
@@ -62,6 +63,7 @@ const Workspace: React.FC = () => {
       {/* Above every other banner: when the backend is gone, nothing else on
           screen is trustworthy and no other message explains why. */}
       <BackendOfflineBanner />
+      <DemoBanner />
 
       {accountReminder && (
         <Suspense fallback={null}>
diff --git a/apps/web/src/frontend/app/shell/DemoBanner.test.tsx b/apps/web/src/frontend/app/shell/DemoBanner.test.tsx
new file mode 100644
index 000000000..2ab8238b3
--- /dev/null
+++ b/apps/web/src/frontend/app/shell/DemoBanner.test.tsx
@@ -0,0 +1,46 @@
+/**
+ * Fox Schema (foxschema)
+ * Copyright 2024-2026 Huy Phan <huyplb@gmail.com>
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import React from 'react';
+import { beforeEach, describe, expect, it } from 'vitest';
+import { render, screen } from '@testing-library/react';
+import { useAuthStore } from '@/platform/authStore';
+import { DemoBanner } from './DemoBanner';
+
+const signIn = (role: string, demo: { on: boolean } | null) =>
+  useAuthStore.setState({
+    user: { id: 'u', email: 'u@example.com', onboardingCompleted: true, role, permissions: [] },
+    status: 'ready',
+    demo,
+  } as never);
+
+beforeEach(() => {
+  useAuthStore.setState({ demo: null });
+});
+
+describe('DemoBanner', () => {
+  it('tells a demo visitor what works and that nothing is saved', () => {
+    signIn('demo', { on: true });
+    render(<DemoBanner />);
+    expect(screen.getByTestId('demo-banner').textContent).toMatch(/browse, compare, and run queries.*Nothing here can be saved/);
+  });
+
+  it('reminds an admin that demo mode is on', () => {
+    signIn('admin', { on: true });
+    render(<DemoBanner />);
+    expect(screen.getByTestId('demo-banner').textContent).toMatch(/Demo mode is on/);
+  });
+
+  it('is absent when demo mode is off, or the server did not say', () => {
+    signIn('demo', { on: false });
+    const { unmount } = render(<DemoBanner />);
+    expect(screen.queryByTestId('demo-banner')).toBeNull();
+    unmount();
+
+    signIn('demo', null);
+    render(<DemoBanner />);
+    expect(screen.queryByTestId('demo-banner')).toBeNull();
+  });
+});
diff --git a/apps/web/src/frontend/app/shell/DemoBanner.tsx b/apps/web/src/frontend/app/shell/DemoBanner.tsx
new file mode 100644
index 000000000..e0a892c8f
--- /dev/null
+++ b/apps/web/src/frontend/app/shell/DemoBanner.tsx
@@ -0,0 +1,33 @@
+/**
+ * Fox Schema (foxschema)
+ * Copyright 2024-2026 Huy Phan <huyplb@gmail.com>
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * Shown on every page while an admin has demo mode on, so a visitor knows
+ * why saving does nothing before the first refusal tells them.
+ */
+import React from 'react';
+import { Eye } from 'lucide-react';
+import { isDemoRole } from '@foxschema/shared';
+import { useAuthStore } from '@/platform/authStore';
+
+export const DemoBanner: React.FC = () => {
+  const demo = useAuthStore((s) => s.demo);
+  const role = useAuthStore((s) => s.user?.role);
+  if (!demo?.on) return null;
+  return (
+    <div
+      data-testid="demo-banner"
+      role="status"
+      className="bg-sky-950/60 border-b border-sky-500/30 px-6 py-1.5 flex items-center gap-2 text-xs text-sky-100"
+    >
+      <Eye className="w-3.5 h-3.5 text-sky-300 shrink-0" />
+      <span className="font-bold">Demo</span>
+      <span className="text-sky-200/90">
+        {isDemoRole(role)
+          ? 'Explore the sample databases: browse, compare, and run queries. Nothing here can be saved or changed.'
+          : 'Demo mode is on: visitors see this banner, and the sign-in page shows the demo login.'}
+      </span>
+    </div>
+  );
+};
diff --git a/apps/web/src/frontend/app/shell/ProfileMenu.test.tsx b/apps/web/src/frontend/app/shell/ProfileMenu.test.tsx
index e1f4bd476..e052d1ab9 100644
--- a/apps/web/src/frontend/app/shell/ProfileMenu.test.tsx
+++ b/apps/web/src/frontend/app/shell/ProfileMenu.test.tsx
@@ -62,6 +62,16 @@ describe('ProfileMenu', () => {
     await vi.waitFor(() => expect(toast).toHaveBeenCalledWith(expect.objectContaining({ title: 'Signed out 2 other sessions' })));
   });
 
+  it('does not offer a demo login to sign the other visitors out', () => {
+    useAuthStore.setState({
+      user: { id: 'demo', email: 'demo@example.com', onboardingCompleted: true, role: 'demo', permissions: [] },
+    } as never);
+    render(<ProfileMenu />);
+    fireEvent.click(screen.getByTestId('profile-menu-trigger'));
+    expect(screen.getByTestId('profile-sign-out')).toBeTruthy();
+    expect(screen.queryByTestId('profile-sign-out-others')).toBeNull();
+  });
+
   it('opens Access control from the avatar menu for the local admin', async () => {
     render(<ProfileMenu />);
     fireEvent.click(screen.getByTestId('profile-menu-trigger'));
diff --git a/apps/web/src/frontend/app/shell/ProfileMenu.tsx b/apps/web/src/frontend/app/shell/ProfileMenu.tsx
index 3ec5cf2bc..6cc55d790 100644
--- a/apps/web/src/frontend/app/shell/ProfileMenu.tsx
+++ b/apps/web/src/frontend/app/shell/ProfileMenu.tsx
@@ -1,4 +1,5 @@
 import React, { lazy, useEffect, useRef, useState } from 'react';
+import { isDemoRole } from '@foxschema/shared';
 import { createPortal } from 'react-dom';
 import { LogOut, Palette, ArrowUpCircle, Globe, Shield, MonitorX, MessageSquarePlus, UserPlus } from 'lucide-react';
 import { apiSignOutOthers } from '@/shared/api/authApi';
@@ -158,21 +159,24 @@ export function ProfileMenu(): React.ReactElement | null {
             <Globe className="w-4 h-4" /> foxschema.com
           </a>
 
-          <button
-            type="button"
-            data-testid="profile-sign-out-others"
-            onClick={() => {
-              setOpen(false);
-              apiSignOutOthers()
-                .then((n) =>
-                  toast({ tone: 'success', title: n === 0 ? 'No other sessions were open' : `Signed out ${n} other session${n === 1 ? '' : 's'}` })
-                )
-                .catch((e: unknown) => toast({ tone: 'warning', title: 'Could not sign out other sessions', body: e instanceof Error ? e.message : undefined }));
-            }}
-            className="w-full flex items-center gap-2 px-4 py-3 text-sm font-semibold text-slate-300 hover:text-slate-100 hover:bg-slate-800/60 transition cursor-pointer border-t border-slate-800"
-          >
-            <MonitorX className="w-4 h-4" /> Sign out other sessions
-          </button>
+          {/* A demo login is every visitor at once; the server refuses this for it. */}
+          {!isDemoRole(user?.role) && (
+            <button
+              type="button"
+              data-testid="profile-sign-out-others"
+              onClick={() => {
+                setOpen(false);
+                apiSignOutOthers()
+                  .then((n) =>
+                    toast({ tone: 'success', title: n === 0 ? 'No other sessions were open' : `Signed out ${n} other session${n === 1 ? '' : 's'}` })
+                  )
+                  .catch((e: unknown) => toast({ tone: 'warning', title: 'Could not sign out other sessions', body: e instanceof Error ? e.message : undefined }));
+              }}
+              className="w-full flex items-center gap-2 px-4 py-3 text-sm font-semibold text-slate-300 hover:text-slate-100 hover:bg-slate-800/60 transition cursor-pointer border-t border-slate-800"
+            >
+              <MonitorX className="w-4 h-4" /> Sign out other sessions
+            </button>
+          )}
 
           <button data-testid="profile-sign-out"
             type="button"
diff --git a/apps/web/src/frontend/features/admin/components/SignInSettingsPanel.test.tsx b/apps/web/src/frontend/features/admin/components/SignInSettingsPanel.test.tsx
index c10fa19a0..0a08227a9 100644
--- a/apps/web/src/frontend/features/admin/components/SignInSettingsPanel.test.tsx
+++ b/apps/web/src/frontend/features/admin/components/SignInSettingsPanel.test.tsx
@@ -15,6 +15,7 @@ const apiSaveSsoProvider = vi.fn();
 const apiSaveMailSettings = vi.fn();
 const apiSetSignInService = vi.fn();
 const apiSetSignInServiceAdmins = vi.fn();
+const apiSaveDemoMode = vi.fn();
 
 vi.mock('@/shared/api/authApi', () => ({
   apiSignInSettings: (...a: unknown[]) => apiSignInSettings(...a),
@@ -26,6 +27,7 @@ vi.mock('@/shared/api/authApi', () => ({
   apiSendTestEmail: vi.fn(),
   apiSetSignInService: (...a: unknown[]) => apiSetSignInService(...a),
   apiSetSignInServiceAdmins: (...a: unknown[]) => apiSetSignInServiceAdmins(...a),
+  apiSaveDemoMode: (...a: unknown[]) => apiSaveDemoMode(...a),
 }));
 
 import { SignInSettingsPanel } from './SignInSettingsPanel';
@@ -55,8 +57,10 @@ beforeEach(() => {
     ],
     mail: { configured: false, source: null, host: '', port: 587, security: 'starttls', username: '', hasPassword: false, from: '' },
     broker: { enabled: false, source: null, url: 'https://foxschema.com/wp-json/foxschema/v1/sso', admins: true, adminsSource: null },
+    demo: { on: false, hint: '' },
   });
   apiSetSignInService.mockReset().mockResolvedValue(undefined);
+  apiSaveDemoMode.mockReset().mockResolvedValue(undefined);
 });
 
 describe('sign-in settings', () => {
@@ -120,3 +124,20 @@ describe('sign-in settings', () => {
     await waitFor(() => expect(apiSetSignInServiceAdmins).toHaveBeenCalledWith(false));
   });
 });
+
+describe('SignInSettingsPanel · demo mode', () => {
+  it('turns demo mode on, and saves the sign-in hint on its own', async () => {
+    render(<SignInSettingsPanel />);
+    const toggle = (await screen.findByTestId('sign-in-demo-toggle')) as HTMLInputElement;
+    expect(toggle.checked).toBe(false);
+    fireEvent.click(toggle);
+    await waitFor(() => expect(apiSaveDemoMode).toHaveBeenCalledWith({ on: true }));
+
+    const save = screen.getByTestId('sign-in-demo-save') as HTMLButtonElement;
+    // Nothing to save until the hint differs from the stored one.
+    expect(save.disabled).toBe(true);
+    fireEvent.change(screen.getByTestId('sign-in-demo-hint'), { target: { value: 'Demo login: demo@x.com / try-fox' } });
+    fireEvent.click(save);
+    await waitFor(() => expect(apiSaveDemoMode).toHaveBeenCalledWith({ hint: 'Demo login: demo@x.com / try-fox' }));
+  });
+});
diff --git a/apps/web/src/frontend/features/admin/components/SignInSettingsPanel.tsx b/apps/web/src/frontend/features/admin/components/SignInSettingsPanel.tsx
index c47454db2..ddd2bd321 100644
--- a/apps/web/src/frontend/features/admin/components/SignInSettingsPanel.tsx
+++ b/apps/web/src/frontend/features/admin/components/SignInSettingsPanel.tsx
@@ -4,17 +4,20 @@
  * SPDX-License-Identifier: Apache-2.0
  *
  * Admin → Sign-in: Google / Microsoft / GitHub sign-in, the email relay that
- * sends invite and reset codes, and the public URL their links point to.
+ * sends invite and reset codes, the public URL their links point to, and demo
+ * mode for a published demo.
  *
  * Secrets are write-only: the server says whether one is stored, never what
  * it is, so an empty secret field on save keeps the stored one. Anything set
  * by environment variables on the server is shown read-only.
  */
 import React, { useCallback, useEffect, useState } from 'react';
+import { DEMO_HINT_MAX } from '@foxschema/shared';
 import { Check, Copy, Loader2 } from 'lucide-react';
 import {
   apiRemoveMailSettings,
   apiRemoveSsoProvider,
+  apiSaveDemoMode,
   apiSaveMailSettings,
   apiSavePublicUrl,
   apiSaveSsoProvider,
@@ -149,10 +152,75 @@ export const SignInSettingsPanel: React.FC = () => {
       </section>
 
       <MailSection mail={state.mail} run={run} />
+
+      <DemoSection demo={state.demo} run={run} />
     </div>
   );
 };
 
+/**
+ * Demo mode says this install is a demo: a banner on every page, and a hint —
+ * the published demo login — on the sign-in page. What a demo account may do
+ * is the Demo role's business, not this switch's.
+ */
+const DemoSection: React.FC<{ demo: SignInSettingsState['demo']; run: Run }> = ({ demo, run }) => {
+  const [hint, setHint] = useState(demo.hint);
+  const save = (input: { on?: boolean; hint?: string }, done: string) =>
+    void run(async () => {
+      const saved = await apiSaveDemoMode(input);
+      // This tab's banner follows at once; other tabs on their next load.
+      useAuthStore.setState({ demo: { on: saved.on, hint: saved.hint || undefined } });
+    }, done);
+  return (
+    <section data-testid="sign-in-demo" className="rounded-lg border border-slate-800 bg-slate-950/40 px-3 py-2.5 space-y-2">
+      <div className="flex items-center gap-2">
+        <h3 className="text-xs font-bold text-slate-200 flex-1">Demo mode</h3>
+        <Status configured={demo.on} source={null} />
+      </div>
+      <p className="text-[11px] text-slate-400 leading-snug">
+        For a published demo with one shared login. Give that account the <b className="text-slate-200">Demo</b> role
+        under Users: it browses, compares and runs queries, and cannot save or change anything, reset its password,
+        or sign the other visitors out. Turning this on shows a demo banner on every page and the hint below on the
+        sign-in page.
+      </p>
+      <label className="inline-flex items-center gap-2 text-xs text-slate-200 cursor-pointer">
+        <input
+          type="checkbox"
+          data-testid="sign-in-demo-toggle"
+          checked={demo.on}
+          onChange={(e) => save({ on: e.target.checked }, e.target.checked ? 'Demo mode is on.' : 'Demo mode is off.')}
+        />
+        This install is a demo
+      </label>
+      <label htmlFor="sign-in-demo-hint" className={`block ${labelCls}`}>
+        Sign-in hint
+      </label>
+      <textarea
+        id="sign-in-demo-hint"
+        data-testid="sign-in-demo-hint"
+        rows={2}
+        maxLength={DEMO_HINT_MAX}
+        value={hint}
+        onChange={(e) => setHint(e.target.value)}
+        placeholder="Demo login: demo@example.com / its password"
+        className={`w-full ${inputCls}`}
+      />
+      <div className="flex items-center gap-2">
+        <button
+          type="button"
+          data-testid="sign-in-demo-save"
+          className={buttonCls}
+          disabled={hint.trim() === demo.hint}
+          onClick={() => save({ hint }, 'Sign-in hint saved.')}
+        >
+          Save hint
+        </button>
+        <p className="text-[11px] text-slate-500">Anyone can read it: put only the demo account's login here.</p>
+      </div>
+    </section>
+  );
+};
+
 type Run = (action: () => Promise<void>, done: string) => Promise<void>;
 
 /**
diff --git a/apps/web/src/frontend/features/admin/lib/adminAccess.test.ts b/apps/web/src/frontend/features/admin/lib/adminAccess.test.ts
index d6057f0b2..255a3763a 100644
--- a/apps/web/src/frontend/features/admin/lib/adminAccess.test.ts
+++ b/apps/web/src/frontend/features/admin/lib/adminAccess.test.ts
@@ -80,11 +80,11 @@ describe('last-admin and own-account locks', () => {
 });
 
 describe('groupUsersByRole', () => {
-  it('lists Admin → Viewer and keeps empty groups by default', () => {
-    expect(ROLE_GROUP_ORDER).toEqual(['admin', 'owner', 'editor', 'viewer']);
+  it('lists Admin → Demo and keeps empty groups by default', () => {
+    expect(ROLE_GROUP_ORDER).toEqual(['admin', 'owner', 'editor', 'viewer', 'demo']);
     const groups = groupUsersByRole([editor, admin]);
-    expect(groups.map((g) => g.role)).toEqual(['admin', 'owner', 'editor', 'viewer']);
-    expect(groups.map((g) => g.label)).toEqual(['Admin', 'Owner', 'Editor', 'Viewer']);
+    expect(groups.map((g) => g.role)).toEqual(['admin', 'owner', 'editor', 'viewer', 'demo']);
+    expect(groups.map((g) => g.label)).toEqual(['Admin', 'Owner', 'Editor', 'Viewer', 'Demo']);
     expect(groups.find((g) => g.role === 'admin')?.users).toEqual([admin]);
     expect(groups.find((g) => g.role === 'editor')?.users).toEqual([editor]);
     expect(groups.find((g) => g.role === 'owner')?.users).toEqual([]);
diff --git a/apps/web/src/frontend/features/admin/lib/adminAccess.ts b/apps/web/src/frontend/features/admin/lib/adminAccess.ts
index 01a8e8f03..273834ba6 100644
--- a/apps/web/src/frontend/features/admin/lib/adminAccess.ts
+++ b/apps/web/src/frontend/features/admin/lib/adminAccess.ts
@@ -115,6 +115,8 @@ export function roleGroupLabel(role: AppRole): string {
       return 'Editor';
     case 'viewer':
       return 'Viewer';
+    case 'demo':
+      return 'Demo';
   }
 }
 
diff --git a/apps/web/src/frontend/features/auth/components/AuthPage.test.tsx b/apps/web/src/frontend/features/auth/components/AuthPage.test.tsx
index 0f5707c61..19e89ce7b 100644
--- a/apps/web/src/frontend/features/auth/components/AuthPage.test.tsx
+++ b/apps/web/src/frontend/features/auth/components/AuthPage.test.tsx
@@ -221,3 +221,23 @@ describe('codes', () => {
     expect(apiRedeemCode).not.toHaveBeenCalled();
   });
 });
+
+describe('a demo install', () => {
+  const signInScreen = async (demo: { on: boolean; hint?: string } | null = null) => {
+    useAuthStore.setState({ status: 'anon', user: null, error: null, busy: false, setupState: null, demo });
+    render(<AuthPage />);
+    await screen.findByTestId('auth-login-form');
+  };
+
+  it('says so on the sign-in page, with the admin’s hint', async () => {
+    await signInScreen({ on: true, hint: 'Demo login: demo@example.com / try-fox-9' });
+    const hint = await screen.findByTestId('auth-demo-hint');
+    expect(hint.textContent).toMatch(/This is a demo of Fox/);
+    expect(hint.textContent).toMatch(/demo@example\.com \/ try-fox-9/);
+  });
+
+  it('shows nothing extra on an ordinary install, or when the server did not say', async () => {
+    await signInScreen({ on: false });
+    expect(screen.queryByTestId('auth-demo-hint')).toBeNull();
+  });
+});
diff --git a/apps/web/src/frontend/features/auth/components/AuthPage.tsx b/apps/web/src/frontend/features/auth/components/AuthPage.tsx
index e9a466a16..dc770aac2 100644
--- a/apps/web/src/frontend/features/auth/components/AuthPage.tsx
+++ b/apps/web/src/frontend/features/auth/components/AuthPage.tsx
@@ -131,6 +131,7 @@ const SignInForm: React.FC<{
   const [password, setPassword] = useState('');
   const [ssoError] = useState<string | null>(readSsoError);
   const caps = useCapsLock();
+  const demo = useAuthStore((s) => s.demo);
 
   // Drop `?sso_error` from the address bar once shown, so a reload is clean.
   useEffect(() => {
@@ -144,6 +145,15 @@ const SignInForm: React.FC<{
 
   return (
     <form onSubmit={submit} data-testid="auth-login-form" className="flex flex-col gap-4">
+      {demo?.on && (
+        <div
+          data-testid="auth-demo-hint"
+          className="rounded-md border border-sky-500/30 bg-sky-950/30 px-3 py-2 text-xs text-sky-100"
+        >
+          <p className="font-bold">This is a demo of Fox</p>
+          {demo.hint && <p className="mt-0.5 whitespace-pre-line text-sky-200/90">{demo.hint}</p>}
+        </div>
+      )}
       <div className="flex flex-col gap-1">
         <label htmlFor="auth-email" className={authLabelCls}>
           Email
diff --git a/apps/web/src/frontend/features/sql-editor/state/useSqlEditorStore.secrets.test.ts b/apps/web/src/frontend/features/sql-editor/state/useSqlEditorStore.secrets.test.ts
new file mode 100644
index 000000000..942ecf308
--- /dev/null
+++ b/apps/web/src/frontend/features/sql-editor/state/useSqlEditorStore.secrets.test.ts
@@ -0,0 +1,72 @@
+/**
+ * Fox Schema (foxschema)
+ * Copyright 2024-2026 Huy Phan <huyplb@gmail.com>
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * App Secrets are merged into a run only for an account that may read them.
+ * Asking without `secrets.view` is refused every time, so a viewer — or a demo
+ * visitor — saw "App Secrets unavailable" under every query.
+ */
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { DEFAULT_ROLE_PERMISSIONS } from '@foxschema/shared';
+
+const executeSql = vi.hoisted(() => vi.fn());
+const resolveAppSecrets = vi.hoisted(() => vi.fn());
+
+vi.mock('@/shared/api/sqlApi', () => ({
+  executeSql: (...args: unknown[]) => executeSql(...args),
+}));
+vi.mock('@/shared/api/appSecretsApi', () => ({
+  resolveAppSecrets: (...args: unknown[]) => resolveAppSecrets(...args),
+}));
+
+import { useAuthStore } from '@/platform/authStore';
+import { useSyncStore } from '@/features/compare';
+import { useSqlEditorStore } from './useSqlEditorStore';
+import { createTab } from './sqlEditorTabLogic';
+
+async function runAs(role: 'viewer' | 'editor' | 'demo') {
+  useAuthStore.setState({
+    user: { id: 'u', email: 'u@example.com', onboardingCompleted: true, role, permissions: DEFAULT_ROLE_PERMISSIONS[role] },
+    status: 'ready',
+  } as never);
+  await useSqlEditorStore.persist.rehydrate();
+  const tab = createTab({ id: 't1', title: 'Q', sql: 'SELECT 1;', selectedConnectionIds: ['c1'] });
+  useSyncStore.setState({ connections: [{ id: 'c1', name: 'Lite', dialect: 'sqlite', hasPassword: true } as never] });
+  useSqlEditorStore.setState({
+    tabs: [tab],
+    activeTabId: tab.id,
+    shareDestinations: false,
+    sharedConnectionIds: [],
+    runningTabId: null,
+    variables: [],
+    resultsByTab: {},
+  });
+  await useSqlEditorStore.getState().execute();
+  return useSqlEditorStore.getState().resultsByTab[tab.id]?.warnings ?? [];
+}
+
+beforeEach(() => {
+  executeSql.mockReset().mockResolvedValue({
+    results: [{ ok: true, columns: ['n'], rows: [[1]], rowCount: 1, truncated: false, durationMs: 1 }],
+  });
+  resolveAppSecrets.mockReset().mockRejectedValue(new Error('Permission denied: this needs "secrets.view".'));
+});
+
+describe('App Secrets in a run', () => {
+  it.each(['viewer', 'demo'] as const)('a %s runs without asking for them, and without a warning', async (role) => {
+    const warnings = await runAs(role);
+    expect(resolveAppSecrets).not.toHaveBeenCalled();
+    expect(warnings.join('\n')).not.toMatch(/App Secrets/);
+    expect(executeSql).toHaveBeenCalledTimes(1);
+  });
+
+  it('an editor’s run still merges them, and says when they cannot be read', async () => {
+    resolveAppSecrets.mockResolvedValueOnce({ secrets: {}, errors: {} });
+    expect(await runAs('editor')).toEqual([]);
+    expect(resolveAppSecrets).toHaveBeenCalledTimes(1);
+
+    resolveAppSecrets.mockRejectedValueOnce(new Error('vault offline'));
+    expect((await runAs('editor')).join('\n')).toMatch(/App Secrets unavailable: vault offline/);
+  });
+});
diff --git a/apps/web/src/frontend/features/sql-editor/state/useSqlEditorStore.ts b/apps/web/src/frontend/features/sql-editor/state/useSqlEditorStore.ts
index bb0020f38..384ee8ba3 100644
--- a/apps/web/src/frontend/features/sql-editor/state/useSqlEditorStore.ts
+++ b/apps/web/src/frontend/features/sql-editor/state/useSqlEditorStore.ts
@@ -28,6 +28,7 @@ import { seekFromLastRow, tableForOrderBy } from '@/features/sql-editor/lib/resu
 import { dialectFeatureReason, supportsDialectFeature } from '@/shared/lib/dialect-features';
 import type { SavedConnectionSummary } from '@/shared/api/authApi';
 import { resolveAppSecrets } from '@/shared/api/appSecretsApi';
+import { useAuthStore } from '@/platform/authStore';
 import { loadSchema } from '@/shared/api/schemaApi';
 import {
   collectMultiTableWriteWarnings,
@@ -1220,17 +1221,22 @@ export const useSqlEditorStore = create<SqlEditorState>()(
           });
 
         // Vault secrets (local + cloud) merge into vars for this Run; session Variables win on name clash.
+        // Only for an account that may read them: asking without `secrets.view`
+        // is refused every time, and a viewer (or a demo visitor) then saw
+        // "App Secrets unavailable" under every query it ran.
         let runVariables = get().variables;
-        try {
-          const vault = await resolveAppSecrets();
-          for (const [name, msg] of Object.entries(vault.errors)) {
-            appendWarning(`Secret "${name}": ${msg}`);
+        if (useAuthStore.getState().can('secrets.view')) {
+          try {
+            const vault = await resolveAppSecrets();
+            for (const [name, msg] of Object.entries(vault.errors)) {
+              appendWarning(`Secret "${name}": ${msg}`);
+            }
+            runVariables = mergeVaultSecretsIntoVariables(get().variables, vault.secrets);
+          } catch (err: unknown) {
+            appendWarning(
+              `App Secrets unavailable: ${err instanceof Error ? err.message : String(err)}`
+            );
           }
-          runVariables = mergeVaultSecretsIntoVariables(get().variables, vault.secrets);
-        } catch (err: unknown) {
-          appendWarning(
-            `App Secrets unavailable: ${err instanceof Error ? err.message : String(err)}`
-          );
         }
 
         const ranDisplay: string[] = [];
diff --git a/apps/web/src/frontend/platform/authStore.ts b/apps/web/src/frontend/platform/authStore.ts
index 7d2e3d20d..d2c89bff1 100644
--- a/apps/web/src/frontend/platform/authStore.ts
+++ b/apps/web/src/frontend/platform/authStore.ts
@@ -16,6 +16,7 @@ import {
   apiSetupState,
   apiVerifyEmail,
   type AuthUser,
+  type DemoModeInfo,
   type RegistrationDue,
   type SessionInfo,
   type SetupState,
@@ -34,6 +35,8 @@ interface AuthState {
   busy: boolean;
   /** First-run setup details, while status is `setup` or a launch session has no account yet. */
   setupState: SetupState | null;
+  /** Whether the install is a demo (banner, sign-in hint); read with the setup state at startup. */
+  demo: DemoModeInfo | null;
   /** The owner, in by `foxschema open` launch link, with no account yet. */
   launch: boolean;
   /** For a launch session: when the account is due. */
@@ -111,6 +114,7 @@ export const useAuthStore = create<AuthState>((set, get) => ({
   error: null,
   busy: false,
   setupState: null,
+  demo: null,
   ...SIGNED_OUT,
   registerDialogOpen: false,
   setRegisterDialogOpen: (open) => set({ registerDialogOpen: open }),
@@ -131,7 +135,7 @@ export const useAuthStore = create<AuthState>((set, get) => ({
       // A dead link (used, expired, another machine) just means the usual page.
       if (launchToken) await apiLaunch(launchToken).catch(() => undefined);
       const [setupState, session] = await Promise.all([apiSetupState(), apiSession()]);
-      set(startState(setupState, session));
+      set({ ...startState(setupState, session), demo: setupState.demo ?? null });
     })().finally(() => {
       initRun = null;
     })),
@@ -201,6 +205,7 @@ export const useAuthStore = create<AuthState>((set, get) => ({
     set({ user: null, status: 'anon', error: null, ...SIGNED_OUT });
     // A launch session leaves the install with no account: setup, not sign-in.
     const setupState = await apiSetupState();
+    set({ demo: setupState.demo ?? null });
     if (setupState.setupRequired) set({ setupState, status: 'setup' });
   },
 
diff --git a/apps/web/src/frontend/shared/api/authApi.ts b/apps/web/src/frontend/shared/api/authApi.ts
index 9bb801d2d..4570f38ac 100644
--- a/apps/web/src/frontend/shared/api/authApi.ts
+++ b/apps/web/src/frontend/shared/api/authApi.ts
@@ -35,6 +35,8 @@ export interface SetupState {
   setupEmail: string | null;
   /** This browser is not on the server's machine: setup needs the code from the server log. */
   setupCodeRequired: boolean;
+  /** Whether the install is a demo; absent from a server that predates demo mode. */
+  demo?: DemoModeInfo;
 }
 
 const NO_SETUP: SetupState = { setupRequired: false, setupEmail: null, setupCodeRequired: false };
@@ -281,12 +283,26 @@ export interface SignInSettingsState {
   mail: MailSettings;
   /** Google / GitHub through the Fox sign-in service on foxschema.com. */
   broker: { enabled: boolean; source: SettingSource | null; url: string; admins: boolean; adminsSource: SettingSource | null };
+  /** Demo mode: a banner on every page and `hint` on the sign-in page. */
+  demo: { on: boolean; hint: string };
 }
 
 export async function apiSignInSettings(): Promise<SignInSettingsState> {
   return api.get('/admin/sign-in', EMPTY_OK);
 }
 
+/** What the sign-in page and the demo banner read: public, before anyone signs in. */
+export interface DemoModeInfo {
+  on: boolean;
+  /** The admin's sign-in hint, typically the published demo login. */
+  hint?: string;
+}
+
+/** Save demo mode; answers the settings as saved (the hint is kept while off). */
+export async function apiSaveDemoMode(input: { on?: boolean; hint?: string }): Promise<{ on: boolean; hint: string }> {
+  return (await api.put<{ demo: { on: boolean; hint: string } }>('/admin/sign-in/demo', input)).demo;
+}
+
 export async function apiSaveSsoProvider(
   id: SsoProviderId,
   input: { clientId: string; clientSecret?: string; tenant?: string }
diff --git a/docs/DEPLOYMENT.md b/docs/DEPLOYMENT.md
index 9e260319e..b598d04a4 100644
--- a/docs/DEPLOYMENT.md
+++ b/docs/DEPLOYMENT.md
@@ -456,6 +456,42 @@ hostnames).
 **Always terminate TLS** (via your reverse proxy or platform) for any internet-facing
 deployment — Fox Schema handles database credentials.
 
+## Publishing a demo
+
+A public demo is one install with one shared login that anyone may use. Two
+settings make that safe:
+
+- **The Demo role.** Give the shared account the `demo` role (Access control →
+  Users). It browses and compares schemas, reads history and access reports,
+  and runs SELECTs. It cannot save or change anything — connections, secrets,
+  workspaces, variables, its own profile — and cannot run server-side code
+  cells, workflows or Git. The server enforces this on every request, whatever
+  workspace the account is in and whatever role a workspace gave it. A visitor
+  also cannot reset the shared password (forgot-password sends nothing for a
+  demo account) or sign the other visitors out. Its permissions are edited like
+  any role's; adding `editor.dml` there turns the demo into a sandbox, since
+  the SQL it may run follows those permissions.
+- **Demo mode** (Access control → Sign-in → Demo mode). Shows a demo banner on
+  every page and your sign-in hint — typically the shared login — on the
+  sign-in page. Anyone can read the hint.
+
+To set one up:
+
+1. Create the account with the `demo` role and a password you are happy to
+   publish.
+2. Give it the demo databases. It cannot add connections itself: as an admin,
+   join its workspace (Access control → Workspaces → Join), open it, add the
+   connections, then leave.
+3. Point those connections at **read-only database accounts** with a statement
+   timeout. The Demo role refuses writes, and the database account is what
+   stops a slow query from tying the demo up.
+4. Turn on demo mode and enter the hint.
+
+Limits worth knowing: the shared account's sign-in lockout is shared too — 50
+wrong passwords from all addresses within 15 minutes lock it for everyone until
+the window passes (a correct sign-in clears the count). Preferences such as the
+theme are one account's, so every visitor shares them.
+
 ## Origin policy
 
 The API holds database credentials and can run migrations, so only named browser
diff --git a/docs/testing/TEST_IDS.md b/docs/testing/TEST_IDS.md
index 2830f50f3..52216ef36 100644
--- a/docs/testing/TEST_IDS.md
+++ b/docs/testing/TEST_IDS.md
@@ -8,7 +8,7 @@ or `TestIds` for the same tree with autocomplete. `{name}` marks a part filled i
 time; "in FilterPicker" marks an ID a shared component draws from the prop written here.
 How to write a test with them: [WRITING_E2E.md](WRITING_E2E.md).
 
-Every control has a test ID: **997** buttons, text boxes, selects and textareas.
+Every control has a test ID: **1000** buttons, text boxes, selects and textareas.
 
 ## access
 
@@ -351,6 +351,10 @@ Every control has a test ID: **997** buttons, text boxes, selects and textareas.
 - **SignInSettingsPanel** · `features/admin/components/SignInSettingsPanel.tsx`
   - `admin-sign-in-settings` · div · Sign in with…
   - `sign-in-copy` · button · Copy
+  - `sign-in-demo` · section · Demo mode
+  - `sign-in-demo-hint` · textarea · Demo login: demo@example.com / its password
+  - `sign-in-demo-save` · button · Save hint
+  - `sign-in-demo-toggle` · input
   - `sign-in-mail` · section · Email for invites and password resets
   - `sign-in-mail-from` · input · Fox &lt;fox@example.com>
   - `sign-in-mail-host` · input · smtp.example.com
@@ -393,6 +397,8 @@ Every control has a test ID: **997** buttons, text boxes, selects and textareas.
   - `command-palette` · div
   - `command-palette-input` · input · Go to a workspace, connection, or recent query…
   - `command-palette-item-{id}` · button
+- **DemoBanner** · `app/shell/DemoBanner.tsx`
+  - `demo-banner` · div
 - **featureRegistry** · `app/features/featureRegistry.ts`
   - `sync-pane-history-btn` · data · Snapshots
   - `view-access-btn` · data
@@ -473,6 +479,7 @@ Every control has a test ID: **997** buttons, text boxes, selects and textareas.
   - `account-verify-status` · span
   - `account-verify-submit` · button · Verify
 - **AuthPage** · `features/auth/components/AuthPage.tsx`
+  - `auth-demo-hint` · div
   - `auth-forgot-link` · button · Forgot password?
   - `auth-have-code` · button · Have an invite or reset code?
   - `auth-login-email` · input · your@email.com
diff --git a/packages/server/src/api/demo-account.test.ts b/packages/server/src/api/demo-account.test.ts
new file mode 100644
index 000000000..49c0313c3
--- /dev/null
+++ b/packages/server/src/api/demo-account.test.ts
@@ -0,0 +1,213 @@
+/**
+ * Fox Schema (foxschema)
+ * Copyright 2024-2026 Huy Phan <huyplb@gmail.com>
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * A demo account against a real server.
+ *
+ * Its login is public, so whatever it may write, every visitor shares. These
+ * tests ask the server that ships, over a socket, the way `http-contract.test.ts`
+ * does: a guard wired to the wrong mount passes every unit test and still
+ * lets the demo save connections.
+ */
+import { describe, it, expect, beforeAll, afterAll } from 'vitest';
+import type { FastifyInstance } from 'fastify';
+
+process.env.APP_DB_PATH = ':memory:';
+process.env.APP_ENCRYPTION_KEY ||= '0'.repeat(64);
+
+import { DEFAULT_ROLE_PERMISSIONS } from '@foxschema/shared';
+import { getStore } from '../database/store';
+import { DEMO_ALLOWED_WRITES, DEMO_READ_ONLY } from '../platform/authorization/demo-access';
+import { FEATURES, createFeatureContext } from '../app/feature-registry';
+
+let port = 0;
+let app: FastifyInstance;
+let admin = '';
+let demo = '';
+let demoId = '';
+let viewer = '';
+
+/** Every route the features mount, with its mount's access, built once. */
+let routeTable: Array<{ method: string; path: string; access: string }> | null = null;
+function mountedRoutes() {
+  if (!routeTable) {
+    const ctx = createFeatureContext();
+    routeTable = FEATURES.flatMap((f) => f.mounts).flatMap((m) =>
+      m.routes(ctx).flatten(m.prefix).map((r) => ({ method: r.method, path: r.path, access: m.access }))
+    );
+  }
+  return routeTable;
+}
+
+const DEMO_EMAIL = 'demo-visitor@example.com';
+const DEMO_PASSWORD = 'shared-demo-login-9';
+
+async function call(method: string, path: string, cookie: string, body?: unknown, headers: Record<string, string> = {}) {
+  const res = await fetch(`http://127.0.0.1:${port}/api${path}`, {
+    method,
+    redirect: 'manual',
+    headers: { cookie, ...(body !== undefined ? { 'content-type': 'application/json' } : {}), ...headers },
+    ...(body !== undefined ? { body: JSON.stringify(body) } : {}),
+  });
+  const text = await res.text();
+  let json: any = null;
+  try {
+    json = JSON.parse(text);
+  } catch {
+    /* not JSON */
+  }
+  return { status: res.status, json, text };
+}
+
+async function login(email: string, password: string): Promise<string> {
+  const res = await fetch(`http://127.0.0.1:${port}/api/auth/login`, {
+    method: 'POST',
+    headers: { 'content-type': 'application/json' },
+    body: JSON.stringify({ email, password }),
+  });
+  expect(res.status, await res.clone().text()).toBe(200);
+  return (res.headers.get('set-cookie') ?? '').split(';')[0]!;
+}
+
+beforeAll(async () => {
+  const { createFastifyApp } = await import('./fastify-server');
+  app = await createFastifyApp({});
+  await app.listen({ port: 0, host: '127.0.0.1' });
+  port = (app.server.address() as { port: number }).port;
+
+  const setup = await fetch(`http://127.0.0.1:${port}/api/auth/setup`, {
+    method: 'POST',
+    headers: { 'content-type': 'application/json' },
+    body: JSON.stringify({ email: 'demo-admin@example.com', password: 'correct-horse-staple-9' }),
+  });
+  expect(setup.status, await setup.clone().text()).toBe(200);
+  admin = (setup.headers.get('set-cookie') ?? '').split(';')[0]!;
+
+  const made = await call('POST', '/admin/users', admin, { email: DEMO_EMAIL, password: DEMO_PASSWORD, role: 'demo' });
+  expect(made.status, made.text).toBe(200);
+  demoId = made.json.user.id;
+  demo = await login(DEMO_EMAIL, DEMO_PASSWORD);
+
+  const v = await call('POST', '/admin/users', admin, { email: 'demo-viewer@example.com', password: 'viewer-pass-12', role: 'viewer' });
+  expect(v.status, v.text).toBe(200);
+  viewer = await login('demo-viewer@example.com', 'viewer-pass-12');
+}, 120_000);
+
+afterAll(async () => {
+  await app?.close();
+});
+
+describe('a demo account', () => {
+  it('has the Demo role’s permissions, and no more in a workspace that made it an owner', async () => {
+    const me = (await call('GET', '/auth/me', demo)).json;
+    expect(me.user.role).toBe('demo');
+    expect([...me.user.permissions].sort()).toEqual([...DEFAULT_ROLE_PERMISSIONS.demo].sort());
+
+    // An admin makes the shared demo login an owner somewhere. Every visitor
+    // would get an owner's keys there; it still acts as Demo.
+    const ws = (await call('POST', '/workspaces', admin, { name: 'Demo data' })).json.workspace;
+    expect((await call('PUT', `/workspaces/${ws.id}/members/${demoId}`, admin, { role: 'owner' })).status).toBe(200);
+    const there = (await call('GET', '/auth/me', demo, undefined, { 'x-fox-workspace': ws.id })).json;
+    // It acts as a viewer there, so every service that reads its role sees one.
+    expect(there.workspace).toMatchObject({ id: ws.id, role: 'viewer' });
+    for (const p of ['editor.dml', 'editor.ddl', 'editor.grant', 'schema.migrate', 'workspace.members', 'secrets.view']) {
+      expect(there.user.permissions, p).not.toContain(p);
+    }
+    expect(there.user.permissions).toContain('editor.run');
+    // The pending invites (other people's emails) and script writing stay closed.
+    expect((await call('GET', `/workspaces/${ws.id}/invites`, demo)).status).toBe(403);
+    expect((await call('GET', '/workspaces/scripts', demo, undefined, { 'x-fox-workspace': ws.id })).json.canWrite).toBe(false);
+    // Nor does it run its own workspace's members.
+    const own = (await call('GET', '/workspaces', demo)).json.workspaces.find((w: { personal: boolean }) => w.personal);
+    expect((await call('GET', `/workspaces/${own.id}/invites`, demo)).status).toBe(403);
+  });
+
+  it('is refused every write behind sign-in except the few that read — before the route runs', async () => {
+    const guarded = mountedRoutes().filter((r) => (r.access === 'user' || r.access === 'registered') && r.method !== 'GET');
+    expect(guarded.length).toBeGreaterThan(50);
+    const allowed = new Set(DEMO_ALLOWED_WRITES.map((r) => `${r.method} ${r.path}`));
+
+    const wrong: string[] = [];
+    for (const route of guarded) {
+      const key = `${route.method} ${route.path}`;
+      const path = route.path.replace(/^\/api/, '').replace(/:(\w+)/g, '00000000-0000-0000-0000-000000000000');
+      const { status, json } = await call(route.method, path, demo, {});
+      const refusedAsDemo = status === 403 && json?.error === DEMO_READ_ONLY;
+      if (allowed.has(key) === refusedAsDemo) wrong.push(`${key} → ${status} ${json?.error ?? ''}`);
+    }
+    expect(wrong, 'allow-listed routes must pass the guard; every other write must be refused').toEqual([]);
+  }, 120_000);
+
+  it('lists only routes that exist — a renamed route fails here instead of closing quietly', () => {
+    const served = new Set(mountedRoutes().map((r) => `${r.method} ${r.path}`));
+    expect(DEMO_ALLOWED_WRITES.map((r) => `${r.method} ${r.path}`).filter((k) => !served.has(k))).toEqual([]);
+  });
+
+  it('runs the reads it is allowed: the guard lets them through to their own checks', async () => {
+    // An empty request reaches the route and is refused for its input, not for being a demo.
+    const run = await call('POST', '/sql/execute', demo, {});
+    expect(run.status).toBe(400);
+    expect(run.json.error).not.toBe(DEMO_READ_ONLY);
+    expect((await call('PUT', '/user/preferences', demo, { onboardingCompleted: true })).status).toBe(200);
+    expect((await call('GET', '/connections', demo)).status).toBe(200);
+    // And it switches between the workspaces it is in.
+    const own = (await call('GET', '/workspaces', demo)).json.workspaces.find((w: { personal: boolean }) => w.personal);
+    expect((await call('POST', `/workspaces/${own.id}/select`, demo, {})).status).toBe(200);
+  });
+
+  it('cannot sign the other visitors out', async () => {
+    const otherVisitor = await login(DEMO_EMAIL, DEMO_PASSWORD);
+    const res = await call('POST', '/auth/sign-out-others', demo, {});
+    expect(res.status).toBe(403);
+    expect(res.json.error).toBe(DEMO_READ_ONLY);
+    expect((await call('GET', '/auth/me', otherVisitor)).json.user?.email).toBe(DEMO_EMAIL);
+    // Everyone else still can.
+    expect((await call('POST', '/auth/sign-out-others', viewer, {})).status).toBe(200);
+  });
+
+  it('cannot have verification mail sent to its address by a visitor', async () => {
+    const res = await call('POST', '/auth/verify/send', demo, {});
+    expect(res.status).toBe(403);
+    expect(res.json.error).toBe(DEMO_READ_ONLY);
+  });
+
+  it('cannot have its password reset by a visitor: forgot sends nothing for it', async () => {
+    const store = await getStore();
+    const codes = async (email: string) =>
+      Number(
+        (
+          await store.get<{ n: number }>(
+            `SELECT COUNT(*) AS n FROM auth_codes c JOIN users u ON u.id = c.user_id WHERE u.email = ? AND c.purpose = 'reset'`,
+            [email]
+          )
+        )?.n ?? 0
+      );
+    // The reply is the same either way; the code is issued after it.
+    expect((await call('POST', '/auth/password/forgot', '', { email: 'demo-viewer@example.com' })).status).toBe(200);
+    expect((await call('POST', '/auth/password/forgot', '', { email: DEMO_EMAIL })).status).toBe(200);
+    await expect.poll(() => codes('demo-viewer@example.com'), { timeout: 5_000 }).toBe(1);
+    expect(await codes(DEMO_EMAIL)).toBe(0);
+  });
+});
+
+describe('demo mode', () => {
+  it('shows the sign-in page its hint only while on, and only an admin sets it', async () => {
+    expect((await call('GET', '/auth/setup', '')).json.demo).toEqual({ on: false });
+
+    const hint = `Demo login: ${DEMO_EMAIL} / ${DEMO_PASSWORD}`;
+    const saved = await call('PUT', '/admin/sign-in/demo', admin, { on: true, hint });
+    expect(saved.status, saved.text).toBe(200);
+    expect((await call('GET', '/auth/setup', '')).json.demo).toEqual({ on: true, hint });
+
+    expect((await call('PUT', '/admin/sign-in/demo', demo, { on: false })).status).toBe(403);
+    expect((await call('PUT', '/admin/sign-in/demo', viewer, { on: false })).status).toBe(403);
+    expect((await call('PUT', '/admin/sign-in/demo', admin, { hint: 'x'.repeat(301) })).status).toBe(400);
+    expect((await call('PUT', '/admin/sign-in/demo', admin, { on: 'yes' })).status).toBe(400);
+
+    // Off again: the hint is kept for next time, and not shown.
+    expect((await call('PUT', '/admin/sign-in/demo', admin, { on: false })).status).toBe(200);
+    expect((await call('GET', '/auth/setup', '')).json.demo).toEqual({ on: false });
+    expect((await call('GET', '/admin/sign-in', admin)).json.demo).toEqual({ on: false, hint });
+  });
+});
diff --git a/packages/server/src/api/http-contract.test.ts b/packages/server/src/api/http-contract.test.ts
index d1391ee1c..93c482343 100644
--- a/packages/server/src/api/http-contract.test.ts
+++ b/packages/server/src/api/http-contract.test.ts
@@ -57,6 +57,7 @@ const ROUTES: RouteExpectation[] = [
   { method: 'GET', path: '/api/admin/role-permissions', status: 200 },
   { method: 'PUT', path: '/api/admin/role-permissions/:role', status: 400 },
   { method: 'GET', path: '/api/admin/sign-in', status: 200 },
+  { method: 'PUT', path: '/api/admin/sign-in/demo', status: 200 },
   { method: 'PUT', path: '/api/admin/sign-in/broker', status: 400 },
   { method: 'DELETE', path: '/api/admin/sign-in/mail', status: 200 },
   { method: 'PUT', path: '/api/admin/sign-in/mail', status: 400 },
diff --git a/packages/server/src/features/auth/auth.routes.ts b/packages/server/src/features/auth/auth.routes.ts
index 714d53275..0d5f19114 100644
--- a/packages/server/src/features/auth/auth.routes.ts
+++ b/packages/server/src/features/auth/auth.routes.ts
@@ -9,9 +9,12 @@ import type { AppRequest } from '../../platform/http/types';
 import { Router } from '../../platform/http/router';
 import { AuthModule, SESSION_COOKIE, SignInLockedError, type AuthUser } from '../../platform/identity/auth.service';
 import { AuthMailer } from '../../platform/identity/auth-mail';
+import { DemoMode } from '../../platform/identity/demo-mode.service';
 import { SignupModule } from '../users';
 import { AppSettingsStore } from '../../platform/settings/app-settings.service';
 import { sendError } from '../../platform/http/respond';
+import { DEMO_READ_ONLY } from '../../platform/authorization/demo-access';
+import { isDemoRole } from '@foxschema/shared';
 import { ServiceError } from '../../platform/contracts/actor';
 import { rateLimit } from '../../platform/guards/rate-limit';
 import { getLogger } from '../../platform/logger/logger';
@@ -21,7 +24,8 @@ import { readCookie, requestedWorkspace, setSessionCookie } from '../../platform
 export function createAuthRoutes(
   auth: AuthModule,
   mailer = new AuthMailer(),
-  signup = new SignupModule(new AppSettingsStore())
+  signup = new SignupModule(new AppSettingsStore()),
+  demo = new DemoMode()
 ): Router {
   const router = Router();
 
@@ -50,14 +54,15 @@ export function createAuthRoutes(
   });
 
   /**
-   * First-run setup state. Says whether setup is still open and whether this
-   * caller will need the setup code, so the sign-in screen can ask for it.
+   * What the app needs before anyone signs in, read once at startup: whether
+   * first-run setup is open and this caller needs the setup code, and whether
+   * the install is a demo (with, only then, the admin's sign-in hint).
    */
   router.get('/setup', async (req: AppRequest, res: FastifyReply) => {
-    const state = await auth.setupState();
+    const [state, demoView] = await Promise.all([auth.setupState(), demo.publicView()]);
     const codeRequired = state.setupRequired && !isDirectLocalRequest(req);
     if (codeRequired) announceSetupCode();
-    res.send({ ...state, setupCodeRequired: codeRequired });
+    res.send({ ...state, setupCodeRequired: codeRequired, demo: demoView });
   });
 
   router.post('/setup', signInLimiter, async (req: AppRequest, res: FastifyReply) => {
@@ -141,6 +146,11 @@ export function createAuthRoutes(
       sendError(res, 'unauthenticated', 'Sign in to verify your email.');
       return;
     }
+    // Any visitor could mail the demo address over and over: its profile is locked.
+    if (isDemoRole(session.user.role)) {
+      sendError(res, 'forbidden', DEMO_READ_ONLY);
+      return;
+    }
     if ((await auth.emailVerification(session.user.id)).verified) {
       res.send({ ok: true, verified: true });
       return;
@@ -243,6 +253,11 @@ export function createAuthRoutes(
       sendError(res, 'unauthenticated', 'Authentication required');
       return;
     }
+    // A demo login is every visitor at once: this would sign all the others out.
+    if (isDemoRole(user.role)) {
+      sendError(res, 'forbidden', DEMO_READ_ONLY);
+      return;
+    }
     res.send({ signedOut: await auth.signOutOtherSessions(user.id, token) });
   });
 
diff --git a/packages/server/src/features/auth/sign-in-settings.routes.ts b/packages/server/src/features/auth/sign-in-settings.routes.ts
index c5ffba5d1..850c5a72e 100644
--- a/packages/server/src/features/auth/sign-in-settings.routes.ts
+++ b/packages/server/src/features/auth/sign-in-settings.routes.ts
@@ -4,8 +4,8 @@
  * SPDX-License-Identifier: Apache-2.0
  *
  * Admin: how people sign in. SSO providers, the email relay for reset and
- * invite codes, and the public URL. Mounted at /api/admin/sign-in behind the
- * session guard; every route needs `admin.users`.
+ * invite codes, the public URL, and demo mode. Mounted at /api/admin/sign-in
+ * behind the session guard; every route needs `admin.users`.
  */
 import type { FastifyReply } from 'fastify';
 import { Router } from '../../platform/http/router';
@@ -16,8 +16,13 @@ import { rateLimit } from '../../platform/guards/rate-limit';
 import { isSsoProviderId, SignInSettings } from '../../platform/identity/sign-in-settings.service';
 import { AuthMailer } from '../../platform/identity/auth-mail';
 import { redirectUri } from '../../platform/identity/sso.service';
+import { DemoMode } from '../../platform/identity/demo-mode.service';
 
-export function createSignInSettingsRoutes(settings = new SignInSettings(), mailer = new AuthMailer(settings)): Router {
+export function createSignInSettingsRoutes(
+  settings = new SignInSettings(),
+  mailer = new AuthMailer(settings),
+  demo = new DemoMode()
+): Router {
   const router = Router();
   const guard = requirePermissions('admin.users');
   const testMailLimiter = rateLimit({ name: 'test-email', windowMs: 60 * 1000, max: 5 });
@@ -26,10 +31,10 @@ export function createSignInSettingsRoutes(settings = new SignInSettings(), mail
     sendError(res, 'invalid_input', error instanceof Error ? error.message : 'Could not save');
 
   router.get('/', guard, async (req: AuthedRequest, res: FastifyReply) => {
-    const summary = await settings.summary();
+    const [summary, demoState] = await Promise.all([settings.summary(), demo.get()]);
     // The callback URL to register with each provider.
     const providers = summary.providers.map((p) => ({ ...p, redirectUri: redirectUri(req, p.id, summary.publicUrl) }));
-    res.send({ ...summary, providers });
+    res.send({ ...summary, providers, demo: demoState });
   });
 
   router.put('/providers/:id', guard, async (req: AuthedRequest, res: FastifyReply) => {
@@ -110,5 +115,14 @@ export function createSignInSettingsRoutes(settings = new SignInSettings(), mail
     }
   });
 
+  /** Demo mode: a banner on every page, and this hint on the sign-in page. */
+  router.put('/demo', guard, async (req: AuthedRequest, res: FastifyReply) => {
+    try {
+      res.send({ demo: await demo.save((req.body ?? {}) as { on?: unknown; hint?: unknown }) });
+    } catch (error: unknown) {
+      fail(res, error);
+    }
+  });
+
   return router;
 }
diff --git a/packages/server/src/features/workspaces/workspace-directory.service.ts b/packages/server/src/features/workspaces/workspace-directory.service.ts
index abffd5155..a1b0475be 100644
--- a/packages/server/src/features/workspaces/workspace-directory.service.ts
+++ b/packages/server/src/features/workspaces/workspace-directory.service.ts
@@ -26,7 +26,7 @@ import {
   CAPPED_ROLE_COLUMNS,
   cappedRole,
   effectiveMemberRole,
-  PERSONAL_OWNER_JOIN,
+  CAPPED_ROLE_JOINS,
   requireWorkspacePermission,
   type StoredRoleRow,
 } from '../../platform/workspaces/workspace.service';
@@ -128,7 +128,7 @@ export class WorkspaceDirectory {
       `SELECT w.id, w.name, w.visibility, w.join_role, ${CAPPED_ROLE_COLUMNS},
               (SELECT COUNT(*) FROM workspace_members x WHERE x.workspace_id = w.id) AS member_count
          FROM workspaces w JOIN workspace_members m ON m.workspace_id = w.id
-         ${PERSONAL_OWNER_JOIN}
+         ${CAPPED_ROLE_JOINS}
         WHERE m.user_id = ? AND w.archived_at IS NULL
         ORDER BY CASE WHEN w.personal_owner_id = ? THEN 0 ELSE 1 END, w.name`,
       [userId, userId]
@@ -298,7 +298,7 @@ export class WorkspaceDirectory {
       `SELECT m.user_id, u.email, ${CAPPED_ROLE_COLUMNS}, a.email AS added_by, m.created_at
          FROM workspace_members m
          JOIN workspaces w ON w.id = m.workspace_id
-         ${PERSONAL_OWNER_JOIN}
+         ${CAPPED_ROLE_JOINS}
          JOIN users u ON u.id = m.user_id
          LEFT JOIN users a ON a.id = m.added_by
         WHERE m.workspace_id = ?
@@ -363,7 +363,7 @@ export class WorkspaceDirectory {
       `SELECT m.workspace_id, u.email, ${CAPPED_ROLE_COLUMNS}
          FROM workspace_members m
          JOIN workspaces w ON w.id = m.workspace_id
-         ${PERSONAL_OWNER_JOIN}
+         ${CAPPED_ROLE_JOINS}
          JOIN users u ON u.id = m.user_id
         WHERE m.role = 'owner' ORDER BY u.email`
     );
diff --git a/packages/server/src/platform/authorization/demo-access.ts b/packages/server/src/platform/authorization/demo-access.ts
new file mode 100644
index 000000000..57da3dd7d
--- /dev/null
+++ b/packages/server/src/platform/authorization/demo-access.ts
@@ -0,0 +1,68 @@
+/**
+ * Fox Schema (foxschema)
+ * Copyright 2024-2026 Huy Phan <huyplb@gmail.com>
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * What a demo account may call.
+ *
+ * A published demo has one account whose login anyone can read, so its
+ * permissions are not the whole story: a write any permission allowed would be
+ * a write every visitor shares. So a demo account may read whatever its role
+ * allows, and may write only through the routes below. Each of them reads,
+ * whatever its verb: a SELECT goes over POST because it carries a body, not
+ * because it changes anything.
+ *
+ * This is an allow-list on purpose. A route added later is closed to the demo
+ * until someone decides it reads, rather than open until someone notices it
+ * writes. `api/demo-account.test.ts` checks every entry against the real route
+ * table, so a renamed route fails the build instead of quietly closing.
+ */
+import { isDemoRole } from '@foxschema/shared';
+
+export interface DemoRoute {
+  method: 'POST' | 'PUT' | 'PATCH' | 'DELETE';
+  /** The route as registered, with `:params`. */
+  path: string;
+  /** Why it only reads, for whoever reviews the list next. */
+  why: string;
+}
+
+export const DEMO_ALLOWED_WRITES: readonly DemoRoute[] = [
+  {
+    method: 'POST',
+    path: '/api/sql/execute',
+    why: 'Runs SQL, and the demo role has no editor.dml, editor.ddl or editor.grant: only reads pass the gate.',
+  },
+  { method: 'POST', path: '/api/sql/code-cell/transpile', why: 'Compiles a TypeScript cell for the browser; never runs it.' },
+  { method: 'POST', path: '/api/schema/list', why: 'Lists schemas.' },
+  { method: 'POST', path: '/api/schema/load', why: 'Reads a schema.' },
+  { method: 'POST', path: '/api/schema/table-insight', why: 'Reads catalog statistics for one table.' },
+  { method: 'POST', path: '/api/schema/db-access', why: 'Reads database users and grants.' },
+  { method: 'POST', path: '/api/compare', why: 'Compares two schemas; deploying the result is schema.migrate.' },
+  {
+    method: 'PUT',
+    path: '/api/user/preferences',
+    why: 'Theme and onboarding state. Shared by every visitor, and harmless to share.',
+  },
+  {
+    method: 'POST',
+    path: '/api/workspaces/:id/select',
+    why: 'Switches the workspace the account acts in (one of its own): a preference, like the theme.',
+  },
+];
+
+/** The answer a demo account gets for anything else. */
+export const DEMO_READ_ONLY = 'This is a read-only demo: browsing, comparing and running queries work; saving and changing do not.';
+
+const READS = new Set(['GET', 'HEAD', 'OPTIONS']);
+
+/**
+ * Whether `role` may call `method path`. Only a demo account is limited;
+ * everyone else answers to their permissions alone.
+ */
+export function demoMayCall(role: unknown, method: string, path: string): boolean {
+  if (!isDemoRole(role)) return true;
+  const verb = method.toUpperCase();
+  if (READS.has(verb)) return true;
+  return DEMO_ALLOWED_WRITES.some((r) => r.method === verb && r.path === path);
+}
diff --git a/packages/server/src/platform/authorization/rbac.service.test.ts b/packages/server/src/platform/authorization/rbac.service.test.ts
index 2584ef326..b487f82dd 100644
--- a/packages/server/src/platform/authorization/rbac.service.test.ts
+++ b/packages/server/src/platform/authorization/rbac.service.test.ts
@@ -210,7 +210,7 @@ describe('RbacModule', () => {
 
   it('role permission matrix covers every role', async () => {
     const matrix = await rbac.listRolePermissionMatrix();
-    expect(Object.keys(matrix).sort()).toEqual(['admin', 'editor', 'owner', 'viewer']);
+    expect(Object.keys(matrix).sort()).toEqual(['admin', 'demo', 'editor', 'owner', 'viewer']);
     expect(matrix.admin).toEqual([...PERMISSIONS]);
   });
 
diff --git a/packages/server/src/platform/identity/auth.guard.ts b/packages/server/src/platform/identity/auth.guard.ts
index e01465c3e..b0cf41045 100644
--- a/packages/server/src/platform/identity/auth.guard.ts
+++ b/packages/server/src/platform/identity/auth.guard.ts
@@ -14,6 +14,7 @@ import type { Permission, WorkspaceRole } from '@foxschema/shared';
 import { type AuthModule, SESSION_COOKIE, SESSION_MAX_AGE_MS, type AuthUser } from './auth.service';
 import { sendError } from '../http/respond';
 import { ServiceError } from '../contracts/actor';
+import { DEMO_READ_ONLY, demoMayCall } from '../authorization/demo-access';
 
 /** Put the resolved session user's identity + grants on the request. */
 export function attachAuthUser(
@@ -84,6 +85,13 @@ export function authGuard(auth: AuthModule) {
         sendError(res, 'unauthenticated', 'Authentication required');
         return;
       }
+      // A demo account reads; it writes only through routes that read (demo-access.ts).
+      // Matched on the registered route, `:params` and all, never the raw URL.
+      // Before the workspace reads below: a refused write needs none of them.
+      if (!demoMayCall(session.user.role, req.method, req.routeOptions?.url ?? '')) {
+        sendError(res, 'forbidden', DEMO_READ_ONLY);
+        return;
+      }
       if (session.launch && (await auth.registrationState()).required) {
         sendError(res, 'forbidden', REGISTER_TO_CONTINUE);
         return;
diff --git a/packages/server/src/platform/identity/auth.service.ts b/packages/server/src/platform/identity/auth.service.ts
index 69a8f609b..b27531f35 100644
--- a/packages/server/src/platform/identity/auth.service.ts
+++ b/packages/server/src/platform/identity/auth.service.ts
@@ -14,7 +14,7 @@ import {
   resolveWorkspace,
   type ResolvedWorkspace,
 } from '../workspaces/workspace.service';
-import { assertPasswordAcceptable, effectivePermissions, type AppRole, type Permission } from '@foxschema/shared';
+import { assertPasswordAcceptable, effectivePermissions, isDemoRole, type AppRole, type Permission } from '@foxschema/shared';
 import {
   CODE_TTL_MS,
   PASSWORD_CODE_PURPOSES,
@@ -185,7 +185,10 @@ export class AuthModule {
   /**
    * The workspace `requestedId` names (or the default one) and what `user`
    * may do in it: install permissions from the account role, workspace
-   * permissions from the role there. An admin keeps every permission.
+   * permissions from the role there. An admin keeps every permission. A demo
+   * account never has more than the Demo role, whatever role a workspace
+   * gave it: inviting the shared demo login as an owner must not hand every
+   * visitor an owner's keys.
    */
   async inWorkspace(
     user: AuthUser,
@@ -197,6 +200,10 @@ export class AuthModule {
       user.role === 'admin'
         ? user.permissions
         : effectivePermissions(user.permissions, await this.rbac.permissionsForRole(workspace.role));
+    if (isDemoRole(user.role)) {
+      const demo = new Set(user.permissions);
+      return { workspace, permissions: permissions.filter((p) => demo.has(p)) };
+    }
     return { workspace, permissions };
   }
 
@@ -268,6 +275,10 @@ export class AuthModule {
       [normalized]
     );
     if (!row || (row.active !== null && row.active !== undefined && Number(row.active) === 0)) return null;
+    // A demo login is shared and its password is public: a visitor asking for
+    // a reset would change it for everyone. Only an admin resets it. Answered
+    // exactly like an unknown email, so the reply says nothing either way.
+    if (isDemoRole(row.app_role)) return null;
     return this.issueCode(row.id, 'reset');
   }
 
diff --git a/packages/server/src/platform/identity/demo-mode.service.ts b/packages/server/src/platform/identity/demo-mode.service.ts
new file mode 100644
index 000000000..bf8369cb6
--- /dev/null
+++ b/packages/server/src/platform/identity/demo-mode.service.ts
@@ -0,0 +1,52 @@
+/**
+ * Fox Schema (foxschema)
+ * Copyright 2024-2026 Huy Phan <huyplb@gmail.com>
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * Demo mode: the install says it is a demo.
+ *
+ * Off, nothing changes. On, every page shows a demo banner and the sign-in
+ * page shows the admin's hint — the published demo login, typically. What a
+ * demo account may *do* is the Demo role's business (`demo-access.ts`); this
+ * only tells visitors where they are and how to get in.
+ */
+import { DEMO_HINT_MAX } from '@foxschema/shared';
+import { AppSettingsStore } from '../settings/app-settings.service';
+
+export const DEMO_MODE_KEY = 'demo.mode';
+export const DEMO_HINT_KEY = 'demo.sign_in_hint';
+
+export interface DemoModeState {
+  on: boolean;
+  /** Shown on the sign-in page while demo mode is on. */
+  hint: string;
+}
+
+export class DemoMode {
+  constructor(private settings = new AppSettingsStore()) {}
+
+  async get(): Promise<DemoModeState> {
+    const [mode, hint] = await Promise.all([this.settings.get(DEMO_MODE_KEY), this.settings.get(DEMO_HINT_KEY)]);
+    return { on: mode === 'on', hint: hint ?? '' };
+  }
+
+  /** What anyone may see before signing in: the hint only while demo mode is on. */
+  async publicView(): Promise<{ on: boolean; hint?: string }> {
+    const state = await this.get();
+    return state.on ? { on: true, ...(state.hint ? { hint: state.hint } : {}) } : { on: false };
+  }
+
+  async save({ on, hint }: { on?: unknown; hint?: unknown }): Promise<DemoModeState> {
+    if (on !== undefined && typeof on !== 'boolean') throw new Error('on must be true or false.');
+    if (hint !== undefined && typeof hint !== 'string') throw new Error('hint must be text.');
+    const trimmed = hint?.trim();
+    if (trimmed !== undefined && trimmed.length > DEMO_HINT_MAX) {
+      throw new Error(`Keep the hint under ${DEMO_HINT_MAX} characters.`);
+    }
+    await Promise.all([
+      on !== undefined && this.settings.set(DEMO_MODE_KEY, on ? 'on' : 'off'),
+      trimmed !== undefined && this.settings.set(DEMO_HINT_KEY, trimmed),
+    ]);
+    return this.get();
+  }
+}
diff --git a/packages/server/src/platform/workspaces/workspace.service.ts b/packages/server/src/platform/workspaces/workspace.service.ts
index 937eb0447..cdba1fd15 100644
--- a/packages/server/src/platform/workspaces/workspace.service.ts
+++ b/packages/server/src/platform/workspaces/workspace.service.ts
@@ -17,6 +17,7 @@
 import { randomUUID } from 'node:crypto';
 import {
   isAppRole,
+  isDemoRole,
   isWorkspaceRole,
   lowerWorkspaceRole,
   permissionSatisfied,
@@ -58,26 +59,41 @@ export function workspaceRoleCeiling(
   return personalOwnerId ? personalRoleFor(personalOwnerAccountRole) : 'owner';
 }
 
+/**
+ * The most a member can do in any workspace, from its own account. A demo
+ * login is shared by every visitor, so it is a viewer wherever it is, whatever
+ * role a workspace gave it. Anyone else is not capped by account role: a viewer
+ * account may own a shared workspace.
+ */
+export function memberRoleCeiling(memberAccountRole: string | null | undefined): WorkspaceRole {
+  return isDemoRole(memberAccountRole) ? 'viewer' : 'owner';
+}
+
 /**
  * Joined into every query that reads a membership role (with `w` the
- * workspace), so the role can be capped. Every read of a member's role goes
- * through this and {@link cappedRole}: a read that skips the cap grants more
- * than the ceiling allows, and nothing fails to show it.
+ * workspace and `m` the membership), so the role can be capped. Every read of
+ * a member's role goes through this and {@link cappedRole}: a read that skips
+ * the cap grants more than the ceiling allows, and nothing fails to show it.
  */
-export const PERSONAL_OWNER_JOIN = 'LEFT JOIN users o ON o.id = w.personal_owner_id';
+export const CAPPED_ROLE_JOINS = 'LEFT JOIN users o ON o.id = w.personal_owner_id LEFT JOIN users mu ON mu.id = m.user_id';
 /** The columns {@link cappedRole} reads, selected beside `m` (the membership). */
-export const CAPPED_ROLE_COLUMNS = 'm.role, w.personal_owner_id, o.app_role AS owner_role';
+export const CAPPED_ROLE_COLUMNS = 'm.role, w.personal_owner_id, o.app_role AS owner_role, mu.app_role AS member_role';
 
 export interface StoredRoleRow {
   role: string;
   personal_owner_id: string | null;
   owner_role: string | null;
+  member_role: string | null;
 }
 
-/** A stored membership role as it takes effect: capped at its workspace's ceiling. Null for a role the store should not hold. */
+/**
+ * A stored membership role as it takes effect: capped at its workspace's
+ * ceiling and at its member's. Null for a role the store should not hold.
+ */
 export function cappedRole(row: StoredRoleRow): WorkspaceRole | null {
   if (!isWorkspaceRole(row.role)) return null;
-  return lowerWorkspaceRole(row.role, workspaceRoleCeiling(row.personal_owner_id, row.owner_role));
+  const inWorkspace = lowerWorkspaceRole(row.role, workspaceRoleCeiling(row.personal_owner_id, row.owner_role));
+  return lowerWorkspaceRole(inWorkspace, memberRoleCeiling(row.member_role));
 }
 
 /**
@@ -94,7 +110,7 @@ export async function effectiveMemberRole(
     `SELECT ${CAPPED_ROLE_COLUMNS}
        FROM workspace_members m
        JOIN workspaces w ON w.id = m.workspace_id
-       ${PERSONAL_OWNER_JOIN}
+       ${CAPPED_ROLE_JOINS}
       WHERE m.workspace_id = ? AND m.user_id = ?`,
     [workspaceId, userId]
   );
@@ -118,7 +134,8 @@ export async function requireWorkspacePermission(
   forbidden = `Permission denied: this needs "${permission}" in this workspace.`
 ): Promise<WorkspaceRole> {
   if (actor.appRole === 'admin') return workspaceGrantCeiling(actor.appRole, null);
-  if (permission === 'workspace.members' && ws.personal_owner_id === actor.userId) {
+  // A demo login does not run even its own workspace's members: every visitor would.
+  if (permission === 'workspace.members' && ws.personal_owner_id === actor.userId && !isDemoRole(actor.appRole)) {
     return personalRoleFor(actor.appRole);
   }
   const role = await effectiveMemberRole(store, ws.id, actor.userId);
@@ -234,7 +251,7 @@ async function memberWorkspace(
   const row = await store.get<StoredRoleRow & { id: string; name: string }>(
     `SELECT w.id, w.name, ${CAPPED_ROLE_COLUMNS}
      FROM workspaces w JOIN workspace_members m ON m.workspace_id = w.id
-     ${PERSONAL_OWNER_JOIN}
+     ${CAPPED_ROLE_JOINS}
      WHERE w.id = ? AND m.user_id = ? AND w.archived_at IS NULL`,
     [workspaceId, userId]
   );
diff --git a/packages/shared/src/permissions.test.ts b/packages/shared/src/permissions.test.ts
index cb39453fd..f89e31f0e 100644
--- a/packages/shared/src/permissions.test.ts
+++ b/packages/shared/src/permissions.test.ts
@@ -14,18 +14,33 @@ import {
 
 describe('role ladder', () => {
   it('orders roles least → most privileged', () => {
-    expect(APP_ROLES).toEqual(['viewer', 'editor', 'owner', 'admin']);
+    expect(APP_ROLES).toEqual(['demo', 'viewer', 'editor', 'owner', 'admin']);
   });
 
   it('each role is a superset of the one below it', () => {
     const has = (r: (typeof APP_ROLES)[number]) => new Set(DEFAULT_ROLE_PERMISSIONS[r]);
-    for (const [lower, higher] of [['viewer', 'editor'], ['editor', 'owner'], ['owner', 'admin']] as const) {
+    for (const [lower, higher] of [['demo', 'viewer'], ['viewer', 'editor'], ['editor', 'owner'], ['owner', 'admin']] as const) {
       for (const p of has(lower)) {
         expect(has(higher).has(p), `${higher} should keep ${p} from ${lower}`).toBe(true);
       }
     }
   });
 
+  it('demo reads and holds nothing that writes, runs code on the server, or reaches beyond its workspace', () => {
+    const demo = new Set(DEFAULT_ROLE_PERMISSIONS.demo);
+    expect(demo.has('editor.run')).toBe(true);
+    expect(demo.has('schema.compare')).toBe(true);
+    for (const p of PERMISSIONS) {
+      const writes =
+        /\.(dml|ddl|grant|write|advanced|insert|update|delete|create|edit|migrate|force|drop|members|settings|design|run|manage|admin|users|roles)$/.test(p) &&
+        p !== 'editor.run';
+      if (writes) expect(demo.has(p), p).toBe(false);
+    }
+    for (const p of ['workflow.access', 'git.view', 'utility.access', 'secrets.view', 'editor.sidebar.secrets'] as const) {
+      expect(demo.has(p), p).toBe(false);
+    }
+  });
+
   it('editor changes data and schema but cannot grant or deploy migrations', () => {
     const editor = new Set(DEFAULT_ROLE_PERMISSIONS.editor);
     expect(editor.has('editor.dml')).toBe(true);
diff --git a/packages/shared/src/permissions.ts b/packages/shared/src/permissions.ts
index 0dca072cd..915e11f32 100644
--- a/packages/shared/src/permissions.ts
+++ b/packages/shared/src/permissions.ts
@@ -11,14 +11,26 @@
  * Ordered least → most privileged. `owner` sits between editor and admin:
  * full power over database schema and data (including GRANT and deploying
  * migrations), but no say over who may use the app — that stays with `admin`.
+ *
+ * `demo` is for a published demo: one account whose login is public. It
+ * reads and never writes, whatever workspace it is in, and its profile is
+ * locked so one visitor cannot sign the others out or change the login.
  */
-export const APP_ROLES = ['viewer', 'editor', 'owner', 'admin'] as const;
+export const APP_ROLES = ['demo', 'viewer', 'editor', 'owner', 'admin'] as const;
 export type AppRole = (typeof APP_ROLES)[number];
 
 export function isAppRole(value: unknown): value is AppRole {
   return typeof value === 'string' && (APP_ROLES as readonly string[]).includes(value);
 }
 
+/** The role for a published demo's shared login (see `DEMO` below). */
+export function isDemoRole(role: unknown): boolean {
+  return role === 'demo';
+}
+
+/** Longest sign-in hint demo mode keeps; the admin panel's box stops at the same length. */
+export const DEMO_HINT_MAX = 300;
+
 /** Fine-grained capabilities enforced on API + UI. */
 export const PERMISSIONS = [
   // Schema Sync
@@ -149,7 +161,15 @@ export const PERMISSION_META: PermissionMeta[] = [
 
 const ALL = [...PERMISSIONS];
 
-const VIEWER: Permission[] = [
+/**
+ * A viewer's reading, without workflows or Git: browse and compare schemas,
+ * read history, inspect access, run SELECTs. Every permission that writes is
+ * absent. Whatever an admin adds here, the server lets a demo account reach
+ * only the routes that read (`DEMO_ALLOWED_WRITES` on the server): saving a
+ * connection, a secret, a workspace or a profile stays closed. What SQL it may
+ * run follows these permissions, so adding `editor.dml` makes a sandbox.
+ */
+const DEMO: Permission[] = [
   'schema.browse',
   'schema.compare',
   'compare.history',
@@ -163,10 +183,11 @@ const VIEWER: Permission[] = [
   'access.access',
   'access.inspector',
   'access.report',
-  'workflow.access',
-  'git.view',
 ];
 
+/** The demo's reading, plus workflows and Git to look at. Each role above builds on the one below. */
+const VIEWER: Permission[] = [...DEMO, 'workflow.access', 'git.view'];
+
 const EDITOR: Permission[] = [
   ...VIEWER,
   // Data and schema on the objects an editor owns day to day. No GRANT (cannot
@@ -209,6 +230,7 @@ const ADMIN: Permission[] = ALL;
 
 /** Built-in defaults when role_permissions has no rows for a role. */
 export const DEFAULT_ROLE_PERMISSIONS: Record<AppRole, Permission[]> = {
+  demo: DEMO,
   viewer: VIEWER,
   editor: EDITOR,
   owner: OWNER,