Source: https://dev-docs.nebula-graph.io/v5.3.2/server-admin/authorization/privilege-reference/
Documentation version: v5.3.2

# Privilege reference

This reference lists actions that can be granted for each resource type. To give a user access for the first time, follow [Configure user access](https://dev-docs.nebula-graph.io/v5.3.2/server-admin/authorization/configure-user-access/). For direct grants, roles, and ownership, see [Authorization overview](https://dev-docs.nebula-graph.io/v5.3.2/server-admin/authorization/).

## Resource objects

NebulaGraph Database Developer Edition supports grants on the following resource objects: service group, catalog, schema, graph type, graph, node type, edge type, node property, edge property, and user-defined procedure (UDP).

These two resource types do not support direct grants:

- Temporary graphs do not support `GRANT` or `REVOKE`. Only the temporary graph owner or a user with `ADMIN` can access a temporary graph.
- User-defined functions (UDFs) have owners, but `GRANT` and `REVOKE` cannot target a `FUNCTION` object directly. For details, see [FUNCTION (UDF)](https://dev-docs.nebula-graph.io/v5.3.2/server-admin/authorization/privilege-reference/#function_udf).

## Grantable actions

### SERVICE GROUP (`SVCGRP`)

 | Action | Description
 | `CONNECT` | Connect to the service group.

### CATALOG

 | Action | Description
 | `CREATE SCHEMA` | Create schemas in the catalog.

### SCHEMA

 | Action | Description
 | `USAGE` | See, select, and reference the schema. Operations on its objects still require the applicable privileges.
 | `DROP` | Drop the schema.
 | `CREATE GRAPH TYPE` | Create graph types in the schema.
 | `ALTER ANY GRAPH TYPE` | Alter any graph type in the schema.
 | `DROP ANY GRAPH TYPE` | Drop any graph type in the schema.
 | `CREATE GRAPH` | Create graphs in the schema.
 | `INSERT ANY GRAPH` | Insert nodes and edges into any graph in the schema.
 | `MATCH ANY GRAPH` | Read nodes and edges in any graph in the schema.
 | `DELETE ANY GRAPH` | Delete nodes and edges from any graph in the schema.
 | `UPDATE ANY GRAPH` | Update nodes and edges in any graph in the schema.
 | `ALTER ANY GRAPH` | Rename any graph, change its comment, or manage its TTL settings.
 | `DROP ANY GRAPH` | Drop any graph in the schema.
 | `CREATE INDEX` | Create indexes in the schema.
 | `DROP ANY INDEX` | Drop any index in the schema.
 | `CREATE PROCEDURE` | Create UDPs in the schema.
 | `ALTER ANY PROCEDURE` | Alter any UDP in the schema.
 | `EXECUTE ANY PROCEDURE` | Call any UDP in the schema.
 | `DROP ANY PROCEDURE` | Drop any UDP in the schema.
 | `CREATE FUNCTION` | Create UDFs in the schema.
 | `DROP ANY FUNCTION` | Drop any UDF in the schema.

### GRAPH TYPE

 | Action | Description
 | `ALTER` | Alter the graph type.
 | `DROP` | Drop the graph type.

### GRAPH

 | Action | Description
 | `MATCH` | Read nodes and edges in the graph.
 | `INSERT` | Insert nodes and edges into the graph.
 | `UPDATE` | Update nodes and edges in the graph.
 | `DELETE` | Delete nodes and edges from the graph.
 | `ALTER` | Rename the graph, change its comment, or manage its TTL settings.
 | `DROP` | Drop the graph.
 | `INDEX` | Create, repair, or drop indexes on the graph.

### NODE TYPE and EDGE TYPE

 | Action | Description
 | `MATCH` | Read elements of the type, including their properties.
 | `INSERT` | Insert elements of the type, including their properties.
 | `UPDATE` | Update elements of the type, including their properties.
 | `DELETE` | Delete elements of the type, including their properties.

### NODE PROPERTY and EDGE PROPERTY

 | Action | Description
 | `MATCH` | Read the property value.
 | `INSERT` | Specify the property value when inserting an element.
 | `UPDATE` | Update the property value.

### PROCEDURE (UDP)

 | Action | Description
 | `EXECUTE` | Call the UDP.
 | `ALTER` | Alter the UDP.
 | `DROP` | Drop the UDP.

### FUNCTION (UDF)

Privileges cannot be granted or revoked directly on a `FUNCTION` object. A UDF owner can drop the owned UDF. Use `CREATE FUNCTION` and `DROP ANY FUNCTION` on the parent schema to control UDF creation and deletion.

## Privilege scope

Privileges on parent resources can cover child resources as follows:

 | Granted privilege | Scope
 | `MATCH ANY GRAPH`, `INSERT ANY GRAPH`, `UPDATE ANY GRAPH`, or `DELETE ANY GRAPH` on a schema | The corresponding operation on every graph in the schema and on their nodes, edges, and properties.
 | `ALTER ANY GRAPH` or `DROP ANY GRAPH` on a schema | Every graph in the schema.
 | `ALTER ANY GRAPH TYPE` or `DROP ANY GRAPH TYPE` on a schema | Every graph type in the schema.
 | `ALTER ANY PROCEDURE`, `EXECUTE ANY PROCEDURE`, or `DROP ANY PROCEDURE` on a schema | Every UDP in the schema.
 | `DROP ANY FUNCTION` on a schema | Every UDF in the schema.
 | `CREATE INDEX` or `DROP ANY INDEX` on a schema | The corresponding index operation on any graph in the schema.
 | `MATCH`, `INSERT`, `UPDATE`, or `DELETE` on a graph | The corresponding node, edge, and property operations in that graph.
 | A data action on a node type or edge type | The corresponding action on the type and its properties.

Important

Schema `USAGE` is independent. Accessing an object in a non-default schema requires both `USAGE` on the schema and the privilege required for the target operation.

## Operations available to resource owners

An owner is the user responsible for managing a resource. Even without an explicit grant, an owner can perform the following operations on the owned resource:

 | Resource type | Operations available to the owner | Supports `ALTER OWNER`
 | Schema | Use and drop the schema; grant or revoke privileges on the schema | Yes
 | Graph type | Alter and drop the graph type; grant or revoke privileges on the graph type | Yes
 | Graph | Query, insert, update, and delete data; alter or drop the graph; manage indexes; grant or revoke privileges on the graph | Yes
 | UDP | Call, alter, and drop the UDP; grant or revoke privileges on the UDP | Yes
 | UDF | Drop the UDF | No

Owning a resource does not automatically provide access to its parent schema. To access a resource in a non-default schema, the owner still needs `USAGE` on that schema.

## Related commands

- Grant or revoke privileges: [GRANT](https://dev-docs.nebula-graph.io/v5.3.2/server-admin/authorization/grant-privilege/) and [REVOKE](https://dev-docs.nebula-graph.io/v5.3.2/server-admin/authorization/revoke-privilege/).
- Inspect grants: [SHOW PRIVILEGES](https://dev-docs.nebula-graph.io/v5.3.2/database-gql-reference/data-admin/show/show-privileges/).
- Inspect ownership: [SHOW OBJECTS](https://dev-docs.nebula-graph.io/v5.3.2/database-gql-reference/data-admin/show/show-objects/).