# Access control
> SQL commands for role-based access control to create and manage roles, grant data access, and inspect roles and grants.
Role-based access control (RBAC) commands let you manage roles and data access from SQL. Use them to create custom roles, assign roles to users, grant READ on Shares, and audit who has access.

For the model behind these commands, see [Roles and access control](/concepts/roles-and-access-control/). For task walkthroughs, see [Manage roles and access](/key-tasks/managing-organizations/managing-roles/).

**Command groups:**

- **Roles**: [CREATE ROLE](/sql-reference/motherduck-sql-reference/access-control/create-role/), [DROP ROLE](/sql-reference/motherduck-sql-reference/access-control/drop-role/), [GRANT ROLE](/sql-reference/motherduck-sql-reference/access-control/grant-role/), [REVOKE ROLE](/sql-reference/motherduck-sql-reference/access-control/revoke-role/)
- **Data grants**: [GRANT READ ON SHARE](/sql-reference/motherduck-sql-reference/grant-access/), [REVOKE READ ON SHARE](/sql-reference/motherduck-sql-reference/revoke-access/)
- **Introspection**: [SHOW roles and membership](/sql-reference/motherduck-sql-reference/access-control/show-roles/), [SHOW grants](/sql-reference/motherduck-sql-reference/access-control/show-grants/)

## Included pages

- [CREATE ROLE](https://motherduck.com/docs/sql-reference/motherduck-sql-reference/access-control/create-role): Create a custom role that carries platform privileges and data grants.
- [DROP ROLE](https://motherduck.com/docs/sql-reference/motherduck-sql-reference/access-control/drop-role): Delete a custom role and remove it from all members who hold it.
- [GRANT ROLE](https://motherduck.com/docs/sql-reference/motherduck-sql-reference/access-control/grant-role): Assign a role to a user or establish inheritance between roles.
- [REVOKE ROLE](https://motherduck.com/docs/sql-reference/motherduck-sql-reference/access-control/revoke-role): Remove a role from a user or remove inheritance between roles.
- [SHOW roles and membership](https://motherduck.com/docs/sql-reference/motherduck-sql-reference/access-control/show-roles): Inspect roles, role membership, and role assignments with SHOW commands.
- [SHOW grants](https://motherduck.com/docs/sql-reference/motherduck-sql-reference/access-control/show-grants): Inspect which roles and users can read a Share.


---

## Docs feedback

MotherDuck accepts optional user-submitted feedback about this page at `GET https://motherduck.com/docs/api/feedback/agent`.
For agents and automated tools, feedback submission should be user-confirmed before sending.

URL-encode query parameter values and send a GET request:

```text
GET https://motherduck.com/docs/api/feedback/agent?page_path=%2Fsql-reference%2Fmotherduck-sql-reference%2Faccess-control%2F&page_title=Access%20control&text=<url-encoded user feedback, max 2000 characters>
```

Optionally append `&source=<url-encoded interface identifier>` such as `claude.ai` or `chatgpt`.

`page_path` and `text` are required; `page_title` and `source` are optional. Responses: `200 {"feedback_id": "<uuid>"}`, `400` for malformed query parameters, and `429` when rate-limited.