Source: https://dev-docs.nebula-graph.io/v5.3.2/server-admin/authorization/grant-privilege/
Documentation version: v5.3.2

# GRANT

`GRANT` adds privileges to a user or role in the current service group.

## Prerequisites

First [connect to the Graph service](https://dev-docs.nebula-graph.io/v5.3.2/get-started/first-query/#connect). Run the command in a GQL client.

- To grant privileges, you must be the owner of the involved resource objects or the user with the role `ADMIN` in the service group.
- When granting to a role, that role must already exist. For more information, see [CREATE ROLE](https://dev-docs.nebula-graph.io/v5.3.2/server-admin/authorization/create-role/).
- When granting to a user, that user must exist and have joined the current service group. For more information, see [Create users](https://dev-docs.nebula-graph.io/v5.3.2/server-admin/authentication/manage-users/#create_users) and [INVITE USER](https://dev-docs.nebula-graph.io/v5.3.2/database-gql-reference/data-admin/invite-user/).

## Limitations

- The role that you want to grant privileges to must not be the role `ADMIN`.
- The resource object on which you want to grant privileges must not be a temporary graph.
- `USAGE` on `/default_schema` cannot be granted. Every user already has implicit access to this schema.

Direct privileges and role privileges are combined. Prefer grants to roles when managing multiple users. For a complete example, see [Configure user access](https://dev-docs.nebula-graph.io/v5.3.2/server-admin/authorization/configure-user-access/).

A user with `ADMIN` already has every privilege in the current service group. Directly granting an ordinary privilege to that user does not expand the user's effective access.

## Syntax

Syntax diagramBNF

 grant_privileges_command  

````
grant_privileges_command ::=
    'GRANT' action (',' action )* ('ON' resource_object_type resource_object_reference (',' resource_object_reference)* )? 'TO'  ( ('USER' user_name) | ( 'ROLE' role_name) )

````

## Parameters

### `action`

The action to grant or revoke. For the actions supported by each resource type, see [Grantable actions](https://dev-docs.nebula-graph.io/v5.3.2/server-admin/authorization/privilege-reference/#grantable_actions).

If the action is on a service group or catalog, the action can be granted to users or roles, and you do not need to specify `resource_object_type` or `resource_object_reference` in the command.

### `resource_object_type`

The type of resource object that the privilege applies to. Valid values include `SCHEMA`, `GRAPH TYPE`, `GRAPH`, `NODE TYPE`, `EDGE TYPE`, `NODE PROPERTY`, `EDGE PROPERTY`, and `PROCEDURE`. For the resource types supported by each action, see [Privilege reference](https://dev-docs.nebula-graph.io/v5.3.2/server-admin/authorization/privilege-reference/).

For more information, see [Resource objects](https://dev-docs.nebula-graph.io/v5.3.2/server-admin/authorization/privilege-reference/#resource_objects).

### `resource_object_reference`

A reference identifies the target resource. Use a name in the current schema or a reference that includes the schema path:

 | Resource type | Reference in the current schema | Reference with a schema path
 | `SCHEMA` | `schema_reference` | `schema_reference`
 | `GRAPH TYPE` and `GRAPH` | `graph_type_name`
`graph_name` | `schema_reference/graph_type_name`
`schema_reference/graph_name`
 | `PROCEDURE` | `procedure_name(parameter_type, ...)` | ``schema_reference/procedure_name`(parameter_type, ...)`
 | `NODE TYPE` and `EDGE TYPE` | `graph_name.node_type_name`
`graph_name.edge_type_name` | `schema_reference/graph_name.node_type_name`
`schema_reference/graph_name.edge_type_name`
 | `NODE PROPERTY` and `EDGE PROPERTY` | `graph_name.node_type_name.node_property_name`
`graph_name.edge_type_name.edge_property_name` | `schema_reference/graph_name.node_type_name.node_property_name`
`schema_reference/graph_name.edge_type_name.edge_property_name`

If multiple UDP signatures have the same name, specify the parameter types. For example:

````
GRANT EXECUTE ON PROCEDURE `/default_schema/ufoo`(INT) TO ROLE role1

````

- Always use `schema_reference` for a `SCHEMA` object.
- For other objects, omit the schema path only when the object is in the current schema. Include `schema_reference` for objects in another schema. To set or view the current schema, see [SESSION SET SCHEMA](https://dev-docs.nebula-graph.io/v5.3.2/database-gql-reference/sessions/set/) and [SHOW CURRENT_SCHEMA](https://dev-docs.nebula-graph.io/v5.3.2/database-gql-reference/data-admin/show/show-current-schema/).
- `schema_reference` can be the absolute or relative path of the schema. For more information, see [CREATE SCHEMA](https://dev-docs.nebula-graph.io/v5.3.2/database-gql-reference/ddl/schema/create/#schema_reference).

### `user_name`

The username receiving the privileges.

### `role_name`

The role receiving the privileges.

## Examples

- Role `role1` must exist and user `user1` must have joined the service group. See [CREATE ROLE](https://dev-docs.nebula-graph.io/v5.3.2/server-admin/authorization/create-role/) to create a role.
- Current-schema examples use `movie` from the [example dataset](https://dev-docs.nebula-graph.io/v5.3.2/database-gql-reference/overview/example-dataset/). Select the schema where it was loaded first.
- Before using `/my_schema` examples, prepare the corresponding objects there or replace the paths with existing object paths.

### Grant access to a schema

Grant `USAGE` directly to a user:

````
GRANT USAGE ON SCHEMA /my_schema TO USER user1

````

Alternatively, grant `USAGE` to a role:

````
GRANT USAGE ON SCHEMA /my_schema TO ROLE role1

````

`USAGE` does not grant privileges on objects in the schema. For example, to allow `user1` to query a graph in `/my_schema`, grant both privileges:

````
'''
GRANT USAGE ON SCHEMA /my_schema TO USER user1
'''

'''
GRANT MATCH ON GRAPH /my_schema/movie TO USER user1
'''

````

For more information, see [Schema access control](https://dev-docs.nebula-graph.io/v5.3.2/server-admin/authorization/schema-access-control/).

### Grant query access to a graph in the current schema

````
GRANT MATCH ON GRAPH movie TO ROLE role1

````

### Grant query access to a graph in another schema

````
GRANT MATCH ON GRAPH /my_schema/movie TO ROLE role1

````

To access the graph, the role must also have `USAGE` on `/my_schema`.

### Grant insert and query access to a node type

````
GRANT INSERT, MATCH ON NODE TYPE movie.Actor TO ROLE role1

````

### Grant query access to a node property

````
GRANT MATCH ON NODE PROPERTY movie.Actor.name TO ROLE role1

````