Access control

Role-based access control (RBAC) commands let you manage roles and data access from SQL. Use them to create custom roles, assign roles to users, grant READ on Shares, and audit who has access.

For the model behind these commands, see Roles and access control. For task walkthroughs, see Manage roles and access.

Command groups:

• Roles: CREATE ROLE, DROP ROLE, GRANT ROLE, REVOKE ROLE
• Data grants: GRANT READ ON SHARE, REVOKE READ ON SHARE
• Introspection: SHOW roles and membership, SHOW grants

CREATE ROLE

Create a custom role that carries platform privileges and data grants.

DROP ROLE

Delete a custom role and remove it from all members who hold it.

GRANT ROLE

Assign a role to a user or establish inheritance between roles.

REVOKE ROLE

Remove a role from a user or remove inheritance between roles.

SHOW roles and membership

Inspect roles, role membership, and role assignments with SHOW commands.

SHOW grants

Inspect which roles and users can read a Share.