Grant & Revoke Permissions

Overview

Ultipa GQLDB provides 40 fine-grained permission operations organized by category. Each operation can be applied at one or more scopes: the database, a specific graph, a node label, an edge label, or a stored procedure within a graph.

When a user attempts an operation, access is allowed only if one of their roles has been granted that permission for the requested scope. Otherwise it is rejected. This is default-deny: a user starts with no access and gains only what is explicitly granted.

• GRANT allows a permission.
• REVOKE removes a grant, returning that permission to the default-denied state.

Scopes

Scopes form a hierarchy from broad to specific:

Choosing the Right Scope

A grant at graph scope does not stand in for one at database scope. These operations are checked at database scope only, and a grant of ALL or ADMIN on GRAPH * does not cover them:

Without MANAGE_QUERY or MANAGE_TASK, an account still sees, cancels and deletes its own queries and tasks, and COMMIT / ROLLBACK / the savepoint statements act only on its own transaction. Passwords, credentials and API keys appear as '***' in the query list.

How a Label-Scoped Grant Behaves

A grant scoped to NODE <label> or EDGE <label> narrows what the account can read, and an unqualified query is narrowed rather than refused. With READ ON GRAPH socialNet NODE movie and nothing else:

GQL
MATCH (n:movie) RETURN count(n)       -- 92, the movie nodes
MATCH (n:account) RETURN count(n)     -- permission denied
MATCH (n) RETURN count(n)             -- 92: narrowed to the permitted label, not an error

The last case is worth knowing: a query that names no label returns fewer rows instead of failing, so a result that looks short may be the permission boundary rather than missing data.

Account Statements and Transactions

Account and permission statements cannot run inside a transaction:

GQL
START TRANSACTION
CREATE USER alice PASSWORD 'secure_password_123'
--   CREATE USER changes accounts or permissions, which cannot be done inside a transaction:
--   run it outside the transaction

Run them outside the transaction. DROP USER and ALTER USER … RENAME TO roll back any transactions the account had open.

Permission Operations

List all available operations and their valid scopes:

GQL
SHOW PERMISSIONS

Returns columns operation, description, and valid_scopes.

Data Operations

Schema (DDL) Operations

Backup & Restore

Stored Procedures & Algorithms

Task & Query Management

Security Management

Infrastructure

Wildcards

Functions and Procedures That Need a Right

A function or procedure that changes state is checked against the right the equivalent statement needs, not merely against the right to call it:

Three consequences worth knowing:

• A CHECK constraint cannot call any of them. The condition must be a plain expression over the row's properties.
• A trigger body cannot call a function that needs a right. A write that fires such a trigger fails, for every account.
• A stored procedure runs with its caller's rights, including the rights needed by the functions its body calls. Creating the procedure still succeeds; the call is what fails.

Because ml.list_models and ml.list_pipelines need only the right to run an algorithm, any account that may run algorithms can read the model catalog — model names, pipelines, accuracy and training-set sizes.

Granting Roles to Users

GQL
GRANT ROLE data_reader TO USER alice

Revoking Roles from Users

GQL
REVOKE ROLE data_reader FROM USER alice

Granting Permissions to Roles

Syntax
<grant statement> ::=
  "GRANT" <operation> [ { "," <operation> } ...] "ON" <scope> "TO" [ "ROLE" ] <role name>

Grant read access on a specific graph:

GQL
GRANT READ ON GRAPH social_network TO ROLE data_reader

Grant multiple operations in one statement:

GQL
GRANT INSERT, UPDATE, DELETE ON GRAPH social_network TO ROLE data_writer

Wildcard operation (all permissions):

GQL
GRANT * ON GRAPH * TO ROLE custom_admin

Database-wide grants:

GQL
GRANT READ ON DATABASE TO ROLE global_reader
GRANT BACKUP ON DATABASE TO ROLE backup_operator
GRANT USER_MANAGEMENT ON DATABASE TO ROLE security_team

Grant on all graphs:

GQL
GRANT READ ON GRAPH * TO ROLE global_reader

Label-level access:

GQL
GRANT READ ON GRAPH social_network NODE Person TO ROLE analytics
GRANT INSERT ON GRAPH social_network EDGE KNOWS TO ROLE analytics

Procedure-level access:

GQL
GRANT EXECUTE_PROCEDURE ON GRAPH sales PROCEDURE calc_revenue TO ROLE analyst
GRANT EXECUTE_PROCEDURE ON GRAPH sales PROCEDURE * TO ROLE proc_runner

Revoking Permissions from Roles

Syntax
<revoke statement> ::=
  "REVOKE" <operation> [ { "," <operation> } ...] "ON" <scope> "FROM" [ "ROLE" ] <role name>

GQL
REVOKE INSERT ON GRAPH social_network FROM ROLE data_writer
REVOKE READ ON GRAPH social_network NODE Person FROM ROLE analytics

Showing Grants

Show all grants in the database:

GQL
SHOW GRANTS

Show grants for a specific user (includes grants inherited from all assigned roles):

GQL
SHOW GRANTS FOR USER alice

Show grants for a specific role:

GQL
SHOW GRANTS FOR ROLE data_reader

Result columns:

Examples

Complete RBAC Setup

GQL
// Create roles
CREATE ROLE app_readonly
CREATE ROLE app_readwrite
CREATE ROLE app_admin

// Create users
CREATE USER frontend_service PASSWORD 'frontend_pwd_12345'
CREATE USER backend_service PASSWORD 'backend_pwd_12345'
CREATE USER admin_user PASSWORD 'admin_pwd_12345'

// Grant permissions to roles
GRANT READ ON GRAPH production TO ROLE app_readonly
GRANT READ, INSERT, UPDATE, DELETE ON GRAPH production TO ROLE app_readwrite
GRANT * ON GRAPH * TO ROLE app_admin

// Assign roles to users
GRANT ROLE app_readonly TO USER frontend_service
GRANT ROLE app_readwrite TO USER backend_service
GRANT ROLE app_admin TO USER admin_user

Label-Level Access Control

GQL
// Analytics team: read Person nodes and KNOWS edges only
CREATE ROLE analytics
GRANT READ ON GRAPH social_network NODE Person TO ROLE analytics
GRANT READ ON GRAPH social_network EDGE KNOWS TO ROLE analytics

Procedure-Level Access Control

GQL
// Allow analyst to run a specific stored procedure
CREATE ROLE revenue_analyst
GRANT EXECUTE_PROCEDURE ON GRAPH sales PROCEDURE calc_revenue TO ROLE revenue_analyst