Skip to content
Developer Edition runs on one host and does not require a product license file. Need multi-host deployment or performance testing at scale? Explore Enterprise Edition

Manage roles and privileges

Use roles to assign the same privileges to multiple users. This guide covers inspecting grants, creating and assigning roles, and changing or revoking access. To give a user access for the first time, follow Configure user access.

Prerequisites

  • You are connected to the target service group. For more information, see Connect and run your first query.
  • To create a role, grant a role to a user, or revoke a role from a user, you must have the ADMIN role.
  • The target user exists and has joined the current service group through INVITE USER.
  • The examples use /default_schema/movie. Load the movie sample data first, or replace this with an existing graph path.

Inspect existing roles and privileges

To list the roles assigned to a user:

SHOW ROLES FOR USER user1

To inspect an existing role, replace movie_reader with its name. If you have no role yet, complete the next section first:

SHOW PRIVILEGES FOR ROLE movie_reader

To list the user's direct grants and role grants:

SHOW PRIVILEGES FOR USER user1

SHOW PRIVILEGES FOR USER does not fully display privileges provided by ADMIN, resource ownership, or privileges on parent resources. After changing access, perform the intended operation as the target user to verify the final result.

Create and assign a role

If multiple users need the same privileges, create one role and assign it to those users.

  1. Create a role. For example, create the read-only role movie_reader:

    CREATE ROLE IF NOT EXISTS movie_reader COMMENT "Read movie graph"

    The user who creates a role becomes its owner. The role owner or a user with ADMIN can change the role description or drop it. Only a user with ADMIN can grant the role to a user or revoke it from a user.

  2. Grant privileges to the role:

    '''
GRANT CONNECT TO ROLE movie_reader
'''

'''
GRANT MATCH ON GRAPH /default_schema/movie TO ROLE movie_reader
'''

    For a resource in a non-default schema, also grant USAGE on that schema. See Configure access by using a role for a complete example.

    The user granting a privilege must own the target resource or have the ADMIN role. For supported resources and actions, see Privilege reference.

  3. Grant the role to a user:

    GRANT ROLE movie_reader TO USER user1

A user can have up to 16 custom roles. Privileges from all assigned roles are combined. A role can be granted only to users, not to other roles.

Modify a role

To add a privilege to a role:

GRANT INSERT ON GRAPH /default_schema/movie TO ROLE movie_reader

To revoke a privilege from a role:

REVOKE INSERT ON GRAPH /default_schema/movie FROM ROLE movie_reader

To change the role description:

ALTER ROLE movie_reader SET COMMENT = "Read movie data"

Changes affect every user with the role. Check the records with SHOW PRIVILEGES FOR ROLE movie_reader, then test the intended operation as the target user.

Revoke or drop a role

To revoke a role from a user:

REVOKE ROLE movie_reader FROM USER user1

To drop a role that is no longer needed:

DROP ROLE movie_reader

If another role, a direct grant, or ownership still provides the same privilege, the user might still be able to perform the operation after a role is revoked or dropped.

Manage direct grants

For temporary or special access needs that apply to one user, grant the privilege directly:

GRANT MATCH ON GRAPH /default_schema/movie TO USER user1

Revoke the privilege when it is no longer needed:

REVOKE MATCH ON GRAPH /default_schema/movie FROM USER user1

Use direct grants for a small number of special cases. When multiple users need the same privileges, use a role so that you do not need to update each user separately.

Manage resource ownership

A resource owner can manage the owned resource even without an explicit grant. Use ALTER OWNER to transfer ownership of a schema, graph type, graph, or UDP:

ALTER OWNER GRAPH /default_schema/movie TO USER user1

Transferring ownership does not grant USAGE on a non-default schema. To access the resource, the new owner must still have access to the parent schema. For the operations available to resource owners, see Privilege reference. For command syntax, see ALTER OWNER.

Command reference