Privilege reference¶

This reference lists actions that can be granted for each resource type. To give a user access for the first time, follow Configure user access. For direct grants, roles, and ownership, see Authorization overview.

Resource objects¶

NebulaGraph Database Developer Edition supports grants on the following resource objects: service group, catalog, schema, graph type, graph, node type, edge type, node property, edge property, and user-defined procedure (UDP).

These two resource types do not support direct grants:

Temporary graphs do not support GRANT or REVOKE. Only the temporary graph owner or a user with ADMIN can access a temporary graph.
User-defined functions (UDFs) have owners, but GRANT and REVOKE cannot target a FUNCTION object directly. For details, see FUNCTION (UDF).

Grantable actions¶

SERVICE GROUP (`SVCGRP`)¶

Action	Description
`CONNECT`	Connect to the service group.

CATALOG¶

Action	Description
`CREATE SCHEMA`	Create schemas in the catalog.

SCHEMA¶

Action	Description
`USAGE`	See, select, and reference the schema. Operations on its objects still require the applicable privileges.
`DROP`	Drop the schema.
`CREATE GRAPH TYPE`	Create graph types in the schema.
`ALTER ANY GRAPH TYPE`	Alter any graph type in the schema.
`DROP ANY GRAPH TYPE`	Drop any graph type in the schema.
`CREATE GRAPH`	Create graphs in the schema.
`INSERT ANY GRAPH`	Insert nodes and edges into any graph in the schema.
`MATCH ANY GRAPH`	Read nodes and edges in any graph in the schema.
`DELETE ANY GRAPH`	Delete nodes and edges from any graph in the schema.
`UPDATE ANY GRAPH`	Update nodes and edges in any graph in the schema.
`ALTER ANY GRAPH`	Rename any graph, change its comment, or manage its TTL settings.
`DROP ANY GRAPH`	Drop any graph in the schema.
`CREATE INDEX`	Create indexes in the schema.
`DROP ANY INDEX`	Drop any index in the schema.
`CREATE PROCEDURE`	Create UDPs in the schema.
`ALTER ANY PROCEDURE`	Alter any UDP in the schema.
`EXECUTE ANY PROCEDURE`	Call any UDP in the schema.
`DROP ANY PROCEDURE`	Drop any UDP in the schema.
`CREATE FUNCTION`	Create UDFs in the schema.
`DROP ANY FUNCTION`	Drop any UDF in the schema.

GRAPH TYPE¶

Action	Description
`ALTER`	Alter the graph type.
`DROP`	Drop the graph type.

GRAPH¶

Action	Description
`MATCH`	Read nodes and edges in the graph.
`INSERT`	Insert nodes and edges into the graph.
`UPDATE`	Update nodes and edges in the graph.
`DELETE`	Delete nodes and edges from the graph.
`ALTER`	Rename the graph, change its comment, or manage its TTL settings.
`DROP`	Drop the graph.
`INDEX`	Create, repair, or drop indexes on the graph.

NODE TYPE and EDGE TYPE¶

Action	Description
`MATCH`	Read elements of the type, including their properties.
`INSERT`	Insert elements of the type, including their properties.
`UPDATE`	Update elements of the type, including their properties.
`DELETE`	Delete elements of the type, including their properties.

NODE PROPERTY and EDGE PROPERTY¶

Action	Description
`MATCH`	Read the property value.
`INSERT`	Specify the property value when inserting an element.
`UPDATE`	Update the property value.

PROCEDURE (UDP)¶

Action	Description
`EXECUTE`	Call the UDP.
`ALTER`	Alter the UDP.
`DROP`	Drop the UDP.

FUNCTION (UDF)¶

Privileges cannot be granted or revoked directly on a FUNCTION object. A UDF owner can drop the owned UDF. Use CREATE FUNCTION and DROP ANY FUNCTION on the parent schema to control UDF creation and deletion.

Privilege scope¶

Privileges on parent resources can cover child resources as follows:

Granted privilege	Scope
`MATCH ANY GRAPH`, `INSERT ANY GRAPH`, `UPDATE ANY GRAPH`, or `DELETE ANY GRAPH` on a schema	The corresponding operation on every graph in the schema and on their nodes, edges, and properties.
`ALTER ANY GRAPH` or `DROP ANY GRAPH` on a schema	Every graph in the schema.
`ALTER ANY GRAPH TYPE` or `DROP ANY GRAPH TYPE` on a schema	Every graph type in the schema.
`ALTER ANY PROCEDURE`, `EXECUTE ANY PROCEDURE`, or `DROP ANY PROCEDURE` on a schema	Every UDP in the schema.
`DROP ANY FUNCTION` on a schema	Every UDF in the schema.
`CREATE INDEX` or `DROP ANY INDEX` on a schema	The corresponding index operation on any graph in the schema.
`MATCH`, `INSERT`, `UPDATE`, or `DELETE` on a graph	The corresponding node, edge, and property operations in that graph.
A data action on a node type or edge type	The corresponding action on the type and its properties.

Important

Schema USAGE is independent. Accessing an object in a non-default schema requires both USAGE on the schema and the privilege required for the target operation.

Operations available to resource owners¶

An owner is the user responsible for managing a resource. Even without an explicit grant, an owner can perform the following operations on the owned resource:

Resource type	Operations available to the owner	Supports `ALTER OWNER`
Schema	Use and drop the schema; grant or revoke privileges on the schema	Yes
Graph type	Alter and drop the graph type; grant or revoke privileges on the graph type	Yes
Graph	Query, insert, update, and delete data; alter or drop the graph; manage indexes; grant or revoke privileges on the graph	Yes
UDP	Call, alter, and drop the UDP; grant or revoke privileges on the UDP	Yes
UDF	Drop the UDF	No

Owning a resource does not automatically provide access to its parent schema. To access a resource in a non-default schema, the owner still needs USAGE on that schema.

Related commands¶

Grant or revoke privileges: GRANT and REVOKE.
Inspect grants: SHOW PRIVILEGES.
Inspect ownership: SHOW OBJECTS.