diff --git a/services/syncbase/server/service.go b/services/syncbase/server/service.go
index 4f7328a..b25d1bd 100644
--- a/services/syncbase/server/service.go
+++ b/services/syncbase/server/service.go
@@ -205,6 +205,8 @@
 		// for a fully initialized service. Fix this with a separate marker.
 		ctx.Infof("Creating initial database: %v", opts.InitialDB)
 		dbPerms := pubutil.FilterTags(sd.GetPerms(), wire.AllDatabaseTags...)
+		allButAdmin := []access.Tag{access.Read, access.Write, access.Resolve}
+		dbPerms.Add(security.BlessingPattern(opts.InitialDB.Blessing), access.TagStrings(allButAdmin...)...)
 		if err := s.createDatabase(ctx, nil, opts.InitialDB, dbPerms, nil); err != nil {
 			return nil, err
 		}
diff --git a/services/syncbase/syncbased/doc.go b/services/syncbase/syncbased/doc.go
index 9237fcf..665582c 100644
--- a/services/syncbase/syncbased/doc.go
+++ b/services/syncbase/syncbased/doc.go
@@ -24,8 +24,9 @@
  -initial-db=
    If specified, a new database with the given id is created when setting up a
    brand new storage instance. Permissions for the database will be the service
-   permissions. Format must conform to v.io/services/syncbase.Id.String:
-   blessing,name
+   permissions; additionally, the blessing specified in the database id will
+   have Read, Write, and Resolve. Format must conform to
+   v.io/services/syncbase.Id.String: blessing,name
  -name=
    Name to mount at.
  -root-dir=
diff --git a/services/syncbase/syncbaselib/opts.go b/services/syncbase/syncbaselib/opts.go
index 1626851..c475d2d 100644
--- a/services/syncbase/syncbaselib/opts.go
+++ b/services/syncbase/syncbaselib/opts.go
@@ -27,5 +27,5 @@
 	f.BoolVar(&o.SkipPublishInNh, "skip-publish-in-nh", false, "Whether to skip publishing in the neighborhood.")
 	f.BoolVar(&o.DevMode, "dev", false, "Whether to run in development mode; required for RPCs such as Service.DevModeUpdateVClock.")
 	f.StringVar(&o.CpuProfile, "cpuprofile", "", "If specified, write the cpu profile to the given filename.")
-	f.StringVar(&o.InitialDB, "initial-db", "", "If specified, a new database with the given id is created when setting up a brand new storage instance. Permissions for the database will be the service permissions. Format must conform to v.io/services/syncbase.Id.String: blessing,name")
+	f.StringVar(&o.InitialDB, "initial-db", "", "If specified, a new database with the given id is created when setting up a brand new storage instance. Permissions for the database will be the service permissions; additionally, the blessing specified in the database id will have Read, Write, and Resolve. Format must conform to v.io/services/syncbase.Id.String: blessing,name")
 }