Grant & Revoke Permissions

Overview

Ultipa GQLDB provides 40 fine-grained permission operations organized by category. Each operation can be applied at one or more scopes: the database, a specific graph, a node label, an edge label, or a stored procedure within a graph.

Use GRANT to add permissions and REVOKE to remove them. Permissions are granted to roles, and roles are then assigned to users.

Scopes

Scopes form a hierarchy from broad to specific:

Permission Operations

List all available operations and their valid scopes:

GQL
SHOW PERMISSIONS

Returns columns operation, description, and valid_scopes.

Data Operations

Schema (DDL) Operations

Backup & Restore

Stored Procedures & Algorithms

Task & Query Management

Security Management

Infrastructure

Wildcards

Granting Roles to Users

GQL
GRANT ROLE data_reader TO USER alice

Revoking Roles from Users

GQL
REVOKE ROLE data_reader FROM USER alice

Granting Permissions to Roles

Syntax
<grant statement> ::=
  "GRANT" <operation> [ { "," <operation> } ...] "ON" <scope> "TO" [ "ROLE" ] <role name>

Grant read access on a specific graph:

GQL
GRANT READ ON GRAPH social_network TO ROLE data_reader

Grant multiple operations in one statement:

GQL
GRANT INSERT, UPDATE, DELETE ON GRAPH social_network TO ROLE data_writer

Wildcard operation (all permissions):

GQL
GRANT * ON GRAPH * TO ROLE custom_admin

Database-wide grants:

GQL
GRANT READ ON DATABASE TO ROLE global_reader
GRANT BACKUP ON DATABASE TO ROLE backup_operator
GRANT USER_MANAGEMENT ON DATABASE TO ROLE security_team

Grant on all graphs:

GQL
GRANT READ ON GRAPH * TO ROLE global_reader

Label-level access:

GQL
GRANT READ ON GRAPH social_network NODE Person TO ROLE analytics
GRANT INSERT ON GRAPH social_network EDGE KNOWS TO ROLE analytics

Procedure-level access:

GQL
GRANT EXECUTE_PROCEDURE ON GRAPH sales PROCEDURE calc_revenue TO ROLE analyst
GRANT EXECUTE_PROCEDURE ON GRAPH sales PROCEDURE * TO ROLE proc_runner

Revoking Permissions from Roles

Syntax
<revoke statement> ::=
  "REVOKE" <operation> [ { "," <operation> } ...] "ON" <scope> "FROM" [ "ROLE" ] <role name>

GQL
REVOKE INSERT ON GRAPH social_network FROM ROLE data_writer
REVOKE READ ON GRAPH social_network NODE Person FROM ROLE analytics

Showing Grants

Show all grants in the database:

GQL
SHOW GRANTS

Show grants for a specific user (includes grants inherited from all assigned roles):

GQL
SHOW GRANTS FOR USER alice

Show grants for a specific role:

GQL
SHOW GRANTS FOR ROLE data_reader

Result columns:

Examples

Complete RBAC Setup

GQL
// Create roles
CREATE ROLE app_readonly
CREATE ROLE app_readwrite
CREATE ROLE app_admin

// Create users
CREATE USER frontend_service PASSWORD 'frontend_pwd_12345'
CREATE USER backend_service PASSWORD 'backend_pwd_12345'
CREATE USER admin_user PASSWORD 'admin_pwd_12345'

// Grant permissions to roles
GRANT READ ON GRAPH production TO ROLE app_readonly
GRANT READ, INSERT, UPDATE, DELETE ON GRAPH production TO ROLE app_readwrite
GRANT * ON GRAPH * TO ROLE app_admin

// Assign roles to users
GRANT ROLE app_readonly TO USER frontend_service
GRANT ROLE app_readwrite TO USER backend_service
GRANT ROLE app_admin TO USER admin_user

Label-Level Access Control

GQL
// Analytics team: read Person nodes and KNOWS edges only
CREATE ROLE analytics
GRANT READ ON GRAPH social_network NODE Person TO ROLE analytics
GRANT READ ON GRAPH social_network EDGE KNOWS TO ROLE analytics

Procedure-Level Access Control

GQL
// Allow analyst to run a specific stored procedure
CREATE ROLE revenue_analyst
GRANT EXECUTE_PROCEDURE ON GRAPH sales PROCEDURE calc_revenue TO ROLE revenue_analyst