Source: https://dev-docs.nebula-graph.io/v5.3.2/server-admin/authorization/manage-roles/
Documentation version: v5.3.2

# Manage roles and privileges

Use roles to assign the same privileges to multiple users. This guide covers inspecting grants, creating and assigning roles, and changing or revoking access. To give a user access for the first time, follow [Configure user access](https://dev-docs.nebula-graph.io/v5.3.2/server-admin/authorization/configure-user-access/).

## Prerequisites

- You are connected to the target service group. For more information, see [Connect and run your first query](https://dev-docs.nebula-graph.io/v5.3.2/get-started/first-query/).
- To create a role, grant a role to a user, or revoke a role from a user, you must have the `ADMIN` role.
- The target user exists and has joined the current service group through `INVITE USER`.
- The examples use `/default_schema/movie`. [Load the movie sample data](https://dev-docs.nebula-graph.io/v5.3.2/get-started/first-query/#load) first, or replace this with an existing graph path.

## Inspect existing roles and privileges

To list the roles assigned to a user:

````
SHOW ROLES FOR USER user1

````

To inspect an existing role, replace `movie_reader` with its name. If you have no role yet, complete the next section first:

````
SHOW PRIVILEGES FOR ROLE movie_reader

````

To list the user's direct grants and role grants:

````
SHOW PRIVILEGES FOR USER user1

````

`SHOW PRIVILEGES FOR USER` does not fully display privileges provided by `ADMIN`, resource ownership, or privileges on parent resources. After changing access, perform the intended operation as the target user to verify the final result.

## Create and assign a role

If multiple users need the same privileges, create one role and assign it to those users.

1. 

Create a role. For example, create the read-only role `movie_reader`:

````
CREATE ROLE IF NOT EXISTS movie_reader COMMENT "Read movie graph"

````

The user who creates a role becomes its owner. The role owner or a user with `ADMIN` can change the role description or drop it. Only a user with `ADMIN` can grant the role to a user or revoke it from a user.

2. 

Grant privileges to the role:

````
'''
GRANT CONNECT TO ROLE movie_reader
'''

'''
GRANT MATCH ON GRAPH /default_schema/movie TO ROLE movie_reader
'''

````

For a resource in a non-default schema, also grant `USAGE` on that schema. See [Configure access by using a role](https://dev-docs.nebula-graph.io/v5.3.2/server-admin/authorization/configure-user-access/#configure_access_by_using_a_role) for a complete example.

The user granting a privilege must own the target resource or have the `ADMIN` role. For supported resources and actions, see [Privilege reference](https://dev-docs.nebula-graph.io/v5.3.2/server-admin/authorization/privilege-reference/).

3. 

Grant the role to a user:

````
GRANT ROLE movie_reader TO USER user1

````

A user can have up to 16 custom roles. Privileges from all assigned roles are combined. A role can be granted only to users, not to other roles.

## Modify a role

To add a privilege to a role:

````
GRANT INSERT ON GRAPH /default_schema/movie TO ROLE movie_reader

````

To revoke a privilege from a role:

````
REVOKE INSERT ON GRAPH /default_schema/movie FROM ROLE movie_reader

````

To change the role description:

````
ALTER ROLE movie_reader SET COMMENT = "Read movie data"

````

Changes affect every user with the role. Check the records with `SHOW PRIVILEGES FOR ROLE movie_reader`, then test the intended operation as the target user.

## Revoke or drop a role

To revoke a role from a user:

````
REVOKE ROLE movie_reader FROM USER user1

````

To drop a role that is no longer needed:

````
DROP ROLE movie_reader

````

If another role, a direct grant, or ownership still provides the same privilege, the user might still be able to perform the operation after a role is revoked or dropped.

## Manage direct grants

For temporary or special access needs that apply to one user, grant the privilege directly:

````
GRANT MATCH ON GRAPH /default_schema/movie TO USER user1

````

Revoke the privilege when it is no longer needed:

````
REVOKE MATCH ON GRAPH /default_schema/movie FROM USER user1

````

Use direct grants for a small number of special cases. When multiple users need the same privileges, use a role so that you do not need to update each user separately.

## Manage resource ownership

A resource owner can manage the owned resource even without an explicit grant. Use `ALTER OWNER` to transfer ownership of a schema, graph type, graph, or UDP:

````
ALTER OWNER GRAPH /default_schema/movie TO USER user1

````

Transferring ownership does not grant `USAGE` on a non-default schema. To access the resource, the new owner must still have access to the parent schema. For the operations available to resource owners, see [Privilege reference](https://dev-docs.nebula-graph.io/v5.3.2/server-admin/authorization/privilege-reference/). For command syntax, see [ALTER OWNER](https://dev-docs.nebula-graph.io/v5.3.2/server-admin/authorization/alter-owner/).

## Command reference

- Manage roles: [CREATE ROLE](https://dev-docs.nebula-graph.io/v5.3.2/server-admin/authorization/create-role/), [ALTER ROLE](https://dev-docs.nebula-graph.io/v5.3.2/server-admin/authorization/alter-role/), and [DROP ROLE](https://dev-docs.nebula-graph.io/v5.3.2/server-admin/authorization/drop-role/).
- Assign roles to users: [GRANT ROLE](https://dev-docs.nebula-graph.io/v5.3.2/server-admin/authorization/grant-role/) and [REVOKE ROLE](https://dev-docs.nebula-graph.io/v5.3.2/server-admin/authorization/revoke-role/).
- Grant or revoke privileges: [GRANT](https://dev-docs.nebula-graph.io/v5.3.2/server-admin/authorization/grant-privilege/) and [REVOKE](https://dev-docs.nebula-graph.io/v5.3.2/server-admin/authorization/revoke-privilege/).
- Inspect roles, privileges, and owners: [SHOW ALL ROLES](https://dev-docs.nebula-graph.io/v5.3.2/database-gql-reference/data-admin/show/show-all-roles/), [SHOW ROLES](https://dev-docs.nebula-graph.io/v5.3.2/database-gql-reference/data-admin/show/show-roles/), [SHOW PRIVILEGES](https://dev-docs.nebula-graph.io/v5.3.2/database-gql-reference/data-admin/show/show-privileges/), and [SHOW OBJECTS](https://dev-docs.nebula-graph.io/v5.3.2/database-gql-reference/data-admin/show/show-objects/).