SHOW grants
Marked preset roles include the permission by default; a custom role qualifies when it inherits a role that includes it. Share owners can inspect grants on Shares they own without this permission.
This read-only command reports who can read a Share. Visibility does not guarantee access. See Roles and access control for the model.
SHOW GRANTS ON SHARE​
List everyone with READ access to a Share: direct role and user grants, plus the automatic grant that an organization-wide or public Share carries.
SHOW GRANTS ON SHARE core_metrics;
Output columns:
| Column | Description |
|---|---|
share_owner | The user who owns the Share. |
grantee_name | The role name or username for a direct grant, or a fixed keyword for a whole-organization (ENTIRE_ORGANIZATION) or public (ALL_USERS) grant. |
grantee_type | The kind of grantee. See the values below. |
privilege | read. |
granted_at | When the grant was made. |
grantee_type is one of:
grantee_type | grantee_name | Produced by |
|---|---|---|
role | the role name | GRANT READ ON SHARE ... TO ROLE |
user | the username | GRANT READ ON SHARE ... TO USER |
organization | ENTIRE_ORGANIZATION | a Share created with ACCESS ORGANIZATION, readable by everyone in the owner's organization |
domain | ALL_USERS | a Share created with ACCESS UNRESTRICTED, readable by anyone with the Share URL |
A Share created with ACCESS ORGANIZATION or ACCESS UNRESTRICTED carries a single automatic grant (ENTIRE_ORGANIZATION or ALL_USERS) rather than individual role or user grants. GRANT and REVOKE apply only to RESTRICTED Shares.
Shares are region-scoped based on your Organization's cloud region. A grant appearing here does not extend across regions: an ACCESS UNRESTRICTED (public) Share is only accessible to MotherDuck users in the same cloud region as the underlying data, while an ACCESS ORGANIZATION Share is only accessible to your Organization's users.