Authorization | Geode Database

<h2 id="authorization" class="position-relative d-flex align-items-center group"> Authorization <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="authorization" aria-haspopup="dialog" aria-label="Share link: Authorization"> Share link </button> </h2><div id="headingShareModal" class="heading-share-modal" role="dialog" aria-modal="true" aria-labelledby="headingShareTitle" hidden> <div class="hsm-dialog" role="document"> <div class="hsm-header"> <h2 id="headingShareTitle" class="h6 mb-0 fw-bold">Share this section</h2> <button type="button" class="hsm-close" aria-label="Close"> </button> </div> <div class="hsm-body"> <label for="headingShareInput" class="form-label small text-muted mb-1 text-uppercase fw-bold" style="font-size: 0.7rem; letter-spacing: 0.5px;">Permalink</label> <div class="input-group mb-4 hsm-url-group"> <input id="headingShareInput" type="text" class="form-control font-monospace" readonly aria-readonly="true" style="font-size: 0.85rem;" /> <button class="btn btn-primary hsm-copy" type="button" aria-label="Copy" title="Copy"> </button> </div> <div class="small fw-bold mb-2 text-muted text-uppercase" style="font-size: 0.7rem; letter-spacing: 0.5px;">Share via</div> <div class="hsm-share-grid"> <a id="share-twitter" class="btn btn-outline-secondary w-100" target="_blank" rel="noopener noreferrer"> Twitter </a> <a id="share-linkedin" class="btn btn-outline-secondary w-100" target="_blank" rel="noopener noreferrer"> LinkedIn </a> <a id="share-facebook" class="btn btn-outline-secondary w-100" target="_blank" rel="noopener noreferrer"> Facebook </a> </div> </div> </div> </div> <style> .heading-share-modal { position: fixed; inset: 0; display: flex; justify-content: center; align-items: center; background: rgba(0, 0, 0, 0.6); z-index: 1050; padding: 1rem; backdrop-filter: blur(4px); -webkit-backdrop-filter: blur(4px); } .heading-share-modal[hidden] { display: none !important; } .hsm-dialog { max-width: 420px; width: 100%; background: var(--bs-body-bg, #fff); color: var(--bs-body-color, #212529); border: 1px solid var(--bs-border-color, rgba(0,0,0,0.1)); border-radius: 1rem; box-shadow: 0 25px 50px -12px rgba(0, 0, 0, 0.25); overflow: hidden; animation: hsm-fade-in 0.2s ease-out; } @keyframes hsm-fade-in { from { opacity: 0; transform: scale(0.95); } to { opacity: 1; transform: scale(1); } } [data-bs-theme="dark"] .hsm-dialog { background: #1e293b; border-color: rgba(255,255,255,0.1); color: #f8f9fa; } .hsm-header { display: flex; justify-content: space-between; align-items: center; padding: 1rem 1.5rem; border-bottom: 1px solid var(--bs-border-color, rgba(0,0,0,0.1)); background: rgba(0,0,0,0.02); } [data-bs-theme="dark"] .hsm-header { background: rgba(255,255,255,0.02); border-color: rgba(255,255,255,0.1); } .hsm-close { background: transparent; border: none; color: inherit; opacity: 0.5; padding: 0.25rem 0.5rem; border-radius: 0.25rem; font-size: 1.2rem; line-height: 1; transition: opacity 0.2s; } .hsm-close:hover { opacity: 1; } .hsm-body { padding: 1.5rem; } .hsm-url-group { display: flex !important; align-items: stretch; } .hsm-url-group .form-control { flex: 1; min-width: 0; margin: 0; background: var(--bs-secondary-bg, #f8f9fa); border-color: var(--bs-border-color, #dee2e6); border-top-right-radius: 0; border-bottom-right-radius: 0; height: 42px; } .hsm-url-group .btn { flex: 0 0 auto; margin: 0; margin-left: -1px; border-top-left-radius: 0; border-bottom-left-radius: 0; height: 42px; display: flex; align-items: center; justify-content: center; padding: 0 1.25rem; z-index: 2; } [data-bs-theme="dark"] .hsm-url-group .form-control { background: #0f172a; border-color: #334155; color: #e2e8f0; } .hsm-share-grid { display: flex; flex-direction: column; gap: 0.5rem; } .hsm-share-grid .btn { display: flex; align-items: center; justify-content: center; font-size: 0.9rem; padding: 0.6rem; border-color: var(--bs-border-color); width: 100%; } [data-bs-theme="dark"] .hsm-share-grid .btn { color: #e2e8f0; border-color: #475569; } [data-bs-theme="dark"] .hsm-share-grid .btn:hover { background: #334155; border-color: #cbd5e1; } </style> <script> (function(){ const modal = document.getElementById('headingShareModal'); if(!modal) return; const input = modal.querySelector('#headingShareInput'); const copyBtn = modal.querySelector('.hsm-copy'); const twitter = modal.querySelector('#share-twitter'); const linkedin = modal.querySelector('#share-linkedin'); const facebook = modal.querySelector('#share-facebook'); const closeBtn = modal.querySelector('.hsm-close'); let lastFocus=null; let trapBound=false; function buildUrl(id){ return window.location.origin + window.location.pathname + '#' + id; } function isOpen(){ return !modal.hasAttribute('hidden'); } function hydrate(id){ const url=buildUrl(id); input.value=url; const enc=encodeURIComponent(url); const text=encodeURIComponent(document.title); if(twitter) twitter.href=`https://twitter.com/intent/tweet?url=${enc}&text=${text}`; if(linkedin) linkedin.href=`https://www.linkedin.com/sharing/share-offsite/?url=${enc}`; if(facebook) facebook.href=`https://www.facebook.com/sharer/sharer.php?u=${enc}`; } function openModal(id){ lastFocus=document.activeElement; hydrate(id); if(!isOpen()){ modal.removeAttribute('hidden'); } requestAnimationFrame(()=>{ input.focus(); }); trapFocus(); } function closeModal(){ if(!isOpen()) return; modal.setAttribute('hidden',''); if(lastFocus && typeof lastFocus.focus==='function') lastFocus.focus(); } function copyCurrent(){ try{ navigator.clipboard.writeText(input.value).then(()=>feedback(true),()=>fallback()); } catch(e){ fallback(); } } function fallback(){ input.select(); try{ document.execCommand('copy'); feedback(true);}catch(e){ feedback(false);} } function feedback(ok){ if(!copyBtn) return; const icon=copyBtn.querySelector('i'); if(!icon) return; const prev=copyBtn.getAttribute('data-prev')||icon.className; if(!copyBtn.getAttribute('data-prev')) copyBtn.setAttribute('data-prev',prev); icon.className= ok ? 'fa-duotone fa-clipboard-check':'fa-duotone fa-circle-exclamation'; setTimeout(()=>{ icon.className=prev; },1800); } function handleShareClick(e){ e.preventDefault(); const btn=e.currentTarget; const id=btn.getAttribute('data-share-target'); if(id) openModal(id); } function bindShareButtons(){ document.querySelectorAll('.h-share').forEach(btn=>{ if(!btn.dataset.hShareBound){ btn.addEventListener('click', handleShareClick); btn.dataset.hShareBound='1'; } }); } bindShareButtons(); if(document.readyState==='loading'){ document.addEventListener('DOMContentLoaded', bindShareButtons); } else { requestAnimationFrame(bindShareButtons); } document.addEventListener('click', function(e){ const shareBtn=e.target.closest && e.target.closest('.h-share'); if(shareBtn && !shareBtn.dataset.hShareBound){ handleShareClick.call(shareBtn, e); } }, true); document.addEventListener('click', e=>{ if(e.target===modal) closeModal(); if(e.target.closest && e.target.closest('.hsm-close')){ e.preventDefault(); closeModal(); } if(copyBtn && (e.target===copyBtn || (e.target.closest && e.target.closest('.hsm-copy')))) { e.preventDefault(); copyCurrent(); } }); document.addEventListener('keydown', e=>{ if(e.key==='Escape' && isOpen()) closeModal(); }); function trapFocus(){ if(trapBound) return; trapBound=true; modal.addEventListener('keydown', f=>{ if(f.key==='Tab' && isOpen()){ const focusable=[...modal.querySelectorAll('a[href],button,input,textarea,select,[tabindex]:not([tabindex="-1"])')].filter(el=>!el.hasAttribute('disabled')); if(!focusable.length) return; const first=focusable[0]; const last=focusable[focusable.length-1]; if(f.shiftKey && document.activeElement===first){ f.preventDefault(); last.focus(); } else if(!f.shiftKey && document.activeElement===last){ f.preventDefault(); first.focus(); } } }); } if(closeBtn) closeBtn.addEventListener('click', e=>{ e.preventDefault(); closeModal(); }); })(); </script>Authorization (AuthZ) determines what authenticated users can access and perform in Geode. This guide covers role-based access control (RBAC), attribute-based access control (ABAC), row-level security (RLS), and fine-grained permissions. <h3 id="overview" class="position-relative d-flex align-items-center group"> Overview <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="overview" aria-haspopup="dialog" aria-label="Share link: Overview"> Share link </button> </h3>Geode provides layered authorization mechanisms: <table> <thead> <tr> <th>Layer</th> <th>Mechanism</th> <th>Granularity</th> <th>Use Case</th> </tr> </thead> <tbody> <tr> <td>1</td> <td>RBAC</td> <td>Role-based</td> <td>User groups, job functions</td> </tr> <tr> <td>2</td> <td>ABAC</td> <td>Attribute-based</td> <td>Dynamic policies, context-aware</td> </tr> <tr> <td>3</td> <td>RLS</td> <td>Row-level</td> <td>Multi-tenancy, data isolation</td> </tr> </tbody> </table> Authorization Flow: <ol> <li>User authenticates (see <a href="/docs/security/authentication/" >Authentication</a> )</li> <li>System evaluates RBAC permissions</li> <li>ABAC policies filter accessible resources</li> <li>RLS policies filter accessible rows</li> <li>Query executes with filtered scope</li> </ol> <h3 id="role-based-access-control-rbac" class="position-relative d-flex align-items-center group"> Role-Based Access Control (RBAC) <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="role-based-access-control-rbac" aria-haspopup="dialog" aria-label="Share link: Role-Based Access Control (RBAC)"> Share link </button> </h3>RBAC assigns permissions to roles, then roles to users. <h4 id="built-in-roles" class="position-relative d-flex align-items-center group"> Built-in Roles <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="built-in-roles" aria-haspopup="dialog" aria-label="Share link: Built-in Roles"> Share link </button> </h4>Geode includes predefined roles: <table> <thead> <tr> <th>Role</th> <th>Description</th> <th>Permissions</th> </tr> </thead> <tbody> <tr> <td><code>admin</code></td> <td>Full system access</td> <td>All operations</td> </tr> <tr> <td><code>dba</code></td> <td>Database administration</td> <td>Schema, users, backup</td> </tr> <tr> <td><code>developer</code></td> <td>Development access</td> <td>Read, write, schema (non-prod)</td> </tr> <tr> <td><code>analyst</code></td> <td>Read-only analytics</td> <td>Read, execute procedures</td> </tr> <tr> <td><code>reader</code></td> <td>Read-only access</td> <td>Read only</td> </tr> <tr> <td><code>writer</code></td> <td>Read and write access</td> <td>Read, write</td> </tr> </tbody> </table> <h4 id="creating-custom-roles" class="position-relative d-flex align-items-center group"> Creating Custom Roles <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="creating-custom-roles" aria-haspopup="dialog" aria-label="Share link: Creating Custom Roles"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Create role CREATE ROLE data_scientist; -- Create role with description CREATE ROLE compliance_officer COMMENT 'Audit and compliance access'; -- List all roles SHOW ROLES; -- Show role details DESCRIBE ROLE data_scientist; -- Drop role DROP ROLE data_scientist; </code></pre></div> <h4 id="granting-permissions" class="position-relative d-flex align-items-center group"> Granting Permissions <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="granting-permissions" aria-haspopup="dialog" aria-label="Share link: Granting Permissions"> Share link </button> </h4>Permission Types: <table> <thead> <tr> <th>Permission</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><code>SELECT</code></td> <td>Read data (MATCH queries)</td> </tr> <tr> <td><code>INSERT</code></td> <td>Create nodes/relationships</td> </tr> <tr> <td><code>UPDATE</code></td> <td>Modify existing data</td> </tr> <tr> <td><code>DELETE</code></td> <td>Remove nodes/relationships</td> </tr> <tr> <td><code>EXECUTE</code></td> <td>Run stored procedures</td> </tr> <tr> <td><code>CREATE</code></td> <td>Create schema objects</td> </tr> <tr> <td><code>ALTER</code></td> <td>Modify schema objects</td> </tr> <tr> <td><code>DROP</code></td> <td>Delete schema objects</td> </tr> <tr> <td><code>GRANT</code></td> <td>Delegate permissions</td> </tr> <tr> <td><code>ADMIN</code></td> <td>Administrative operations</td> </tr> </tbody> </table> Grant Examples: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Grant read access to specific graph GRANT SELECT ON GRAPH SocialNetwork TO analyst; -- Grant write access to specific node type GRANT INSERT, UPDATE ON GRAPH SocialNetwork.Person TO writer; -- Grant all data operations GRANT SELECT, INSERT, UPDATE, DELETE ON GRAPH * TO developer; -- Grant schema modification GRANT CREATE, ALTER, DROP ON SCHEMA SocialNetwork TO dba; -- Grant procedure execution GRANT EXECUTE ON PROCEDURE analytics.* TO data_scientist; -- Grant with grant option (can delegate) GRANT SELECT ON GRAPH SocialNetwork TO team_lead WITH GRANT OPTION; </code></pre></div> <h4 id="revoking-permissions" class="position-relative d-flex align-items-center group"> Revoking Permissions <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="revoking-permissions" aria-haspopup="dialog" aria-label="Share link: Revoking Permissions"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Revoke specific permission REVOKE INSERT ON GRAPH SocialNetwork.Person FROM writer; -- Revoke all permissions on object REVOKE ALL ON GRAPH SocialNetwork FROM developer; -- Revoke role from user REVOKE ROLE analyst FROM alice; -- Revoke with cascade (revoke delegated permissions too) REVOKE SELECT ON GRAPH SocialNetwork FROM team_lead CASCADE; </code></pre></div> <h4 id="assigning-roles-to-users" class="position-relative d-flex align-items-center group"> Assigning Roles to Users <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="assigning-roles-to-users" aria-haspopup="dialog" aria-label="Share link: Assigning Roles to Users"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Grant role to user GRANT ROLE analyst TO alice; -- Grant multiple roles GRANT ROLE analyst, reader TO bob; -- Show user roles SHOW ROLES FOR USER alice; -- Revoke role from user REVOKE ROLE analyst FROM alice; </code></pre></div> <h4 id="role-hierarchy" class="position-relative d-flex align-items-center group"> Role Hierarchy <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="role-hierarchy" aria-haspopup="dialog" aria-label="Share link: Role Hierarchy"> Share link </button> </h4>Create role hierarchies for inheritance: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Create role hierarchy CREATE ROLE senior_analyst; GRANT ROLE analyst TO senior_analyst; -- Inherits analyst permissions -- Add additional permissions GRANT EXECUTE ON PROCEDURE analytics.* TO senior_analyst; -- Assign hierarchy role GRANT ROLE senior_analyst TO charlie; -- charlie now has: analyst permissions + procedure execution </code></pre></div> <h3 id="attribute-based-access-control-abac" class="position-relative d-flex align-items-center group"> Attribute-Based Access Control (ABAC) <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="attribute-based-access-control-abac" aria-haspopup="dialog" aria-label="Share link: Attribute-Based Access Control (ABAC)"> Share link </button> </h3>ABAC provides dynamic, context-aware authorization using attributes. <h4 id="policy-components" class="position-relative d-flex align-items-center group"> Policy Components <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="policy-components" aria-haspopup="dialog" aria-label="Share link: Policy Components"> Share link </button> </h4>ABAC policies evaluate: <ul> <li>Subject attributes: User properties (department, clearance, location)</li> <li>Resource attributes: Data properties (classification, owner, type)</li> <li>Action: Operation being performed (SELECT, INSERT, etc.)</li> <li>Environment: Context (time, IP address, device)</li> </ul> <h4 id="creating-abac-policies" class="position-relative d-flex align-items-center group"> Creating ABAC Policies <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="creating-abac-policies" aria-haspopup="dialog" aria-label="Share link: Creating ABAC Policies"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Policy: Only Data Science department can access ML models CREATE POLICY ml_model_access FOR SELECT ON :MLModel WHEN current_user.department = 'Data Science'; -- Policy: Clearance level requirement CREATE POLICY classified_data_access FOR SELECT ON :Document WHEN current_user.clearance_level >= resource.classification_level; -- Policy: Time-based access CREATE POLICY business_hours_only FOR SELECT ON :FinancialData WHEN current_time BETWEEN '09:00:00' AND '17:00:00' AND current_day NOT IN ('Saturday', 'Sunday'); -- Policy: Geographic restriction CREATE POLICY us_data_residency FOR SELECT ON :Customer WHEN resource.country = 'US' AND current_user.location_country = 'US'; </code></pre></div> <h4 id="policy-functions" class="position-relative d-flex align-items-center group"> Policy Functions <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="policy-functions" aria-haspopup="dialog" aria-label="Share link: Policy Functions"> Share link </button> </h4>Built-in functions for policy evaluation: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- User context functions current_user.username -- Current username current_user.roles -- User's roles (array) current_user.department -- User department attribute current_user.clearance_level -- User clearance level has_role('admin') -- Check if user has role -- Session context functions current_session.ip_address -- Client IP address current_session.created_at -- Session start time current_session.mfa_verified -- MFA status -- Time functions current_time -- Current time (HH:MM:SS) current_date -- Current date (YYYY-MM-DD) current_timestamp -- Current timestamp current_day -- Day of week name -- Resource functions resource.<property> -- Access resource property </code></pre></div> <h4 id="combining-policies" class="position-relative d-flex align-items-center group"> Combining Policies <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="combining-policies" aria-haspopup="dialog" aria-label="Share link: Combining Policies"> Share link </button> </h4>Multiple policies combine with AND logic: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Policy 1: Department check CREATE POLICY dept_policy FOR SELECT ON :SensitiveData WHEN current_user.department = resource.owning_department; -- Policy 2: Clearance check CREATE POLICY clearance_policy FOR SELECT ON :SensitiveData WHEN current_user.clearance_level >= resource.classification; -- Both policies must pass for access -- User must be in correct department AND have sufficient clearance </code></pre></div> <h4 id="policy-management" class="position-relative d-flex align-items-center group"> Policy Management <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="policy-management" aria-haspopup="dialog" aria-label="Share link: Policy Management"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- List all policies SHOW POLICIES; -- Show policies for specific type SHOW POLICIES ON :Person; -- Enable/disable policy DISABLE POLICY dept_policy; ENABLE POLICY dept_policy; -- Drop policy DROP POLICY ml_model_access; </code></pre></div> <h3 id="row-level-security-rls" class="position-relative d-flex align-items-center group"> Row-Level Security (RLS) <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="row-level-security-rls" aria-haspopup="dialog" aria-label="Share link: Row-Level Security (RLS)"> Share link </button> </h3>RLS provides fine-grained access control at the row (node/relationship) level. <h4 id="rls-overview" class="position-relative d-flex align-items-center group"> RLS Overview <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="rls-overview" aria-haspopup="dialog" aria-label="Share link: RLS Overview"> Share link </button> </h4>RLS policies are transparent to applications: <ul> <li>Automatically applied to all queries</li> <li>No query rewriting needed</li> <li>Users see only permitted data</li> <li>Violations return empty results (not errors)</li> </ul> <h4 id="creating-rls-policies" class="position-relative d-flex align-items-center group"> Creating RLS Policies <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="creating-rls-policies" aria-haspopup="dialog" aria-label="Share link: Creating RLS Policies"> Share link </button> </h4>SELECT Policies (control visibility): <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Multi-tenant isolation CREATE POLICY tenant_isolation ON Person FOR SELECT USING (tenant_id = current_user_tenant_id()); -- Data ownership CREATE POLICY owner_access ON Document FOR SELECT USING ( owner_id = current_user.id OR is_public = true OR has_role('admin') ); -- Classification-based access CREATE POLICY classification_filter ON Record FOR SELECT USING ( classification IN ('public', 'internal') OR (classification = 'confidential' AND has_role('manager')) OR (classification = 'secret' AND has_role('executive')) ); </code></pre></div>INSERT Policies (control creation): <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Users can only create in their tenant CREATE POLICY tenant_insert ON Person FOR INSERT USING (tenant_id = current_user_tenant_id()); -- Validate data on insert CREATE POLICY valid_classification ON Document FOR INSERT USING (classification IN ('public', 'internal', 'confidential')); </code></pre></div>UPDATE Policies (control modification): <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Users can only update their own data CREATE POLICY owner_update ON Profile FOR UPDATE USING (owner_id = current_user.id); -- Prevent modification of archived data CREATE POLICY no_archive_update ON Document FOR UPDATE USING (status != 'archived'); </code></pre></div>DELETE Policies (control deletion): <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Only owners or admins can delete CREATE POLICY owner_delete ON Document FOR DELETE USING ( owner_id = current_user.id OR has_role('admin') ); -- Soft delete only (prevent hard delete) CREATE POLICY soft_delete_only ON AuditRecord FOR DELETE USING (false); -- Always deny hard delete </code></pre></div> <h4 id="rls-for-relationships" class="position-relative d-flex align-items-center group"> RLS for Relationships <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="rls-for-relationships" aria-haspopup="dialog" aria-label="Share link: RLS for Relationships"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Relationship visibility based on node access CREATE POLICY relationship_visibility ON KNOWS FOR SELECT USING ( -- User must be able to see both endpoints EXISTS( MATCH (a)-[this]->(b) WHERE can_access(a) AND can_access(b) ) ); -- Tenant isolation for relationships CREATE POLICY relationship_tenant ON WORKS_AT FOR SELECT USING ( start_node.tenant_id = current_user_tenant_id() AND end_node.tenant_id = current_user_tenant_id() ); </code></pre></div> <h4 id="rls-context-variables" class="position-relative d-flex align-items-center group"> RLS Context Variables <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="rls-context-variables" aria-haspopup="dialog" aria-label="Share link: RLS Context Variables"> Share link </button> </h4>Set session context for RLS evaluation: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Set session variables SET session.tenant_id = 'tenant-123'; SET session.user_department = 'Engineering'; SET session.clearance_level = 3; -- Use in RLS policies CREATE POLICY tenant_filter ON * FOR SELECT USING (tenant_id = session.tenant_id); </code></pre></div>Client-Side Context Setting: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-go" data-lang="go">// Go client example ctx := context.WithValue(ctx, "tenant_id", "tenant-123") client.Query(ctx, "MATCH (n) RETURN n") </code></pre></div><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-python" data-lang="python"># Python client example async with client.session(tenant_id="tenant-123") as session: await session.run("MATCH (n) RETURN n") </code></pre></div> <h4 id="rls-performance" class="position-relative d-flex align-items-center group"> RLS Performance <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="rls-performance" aria-haspopup="dialog" aria-label="Share link: RLS Performance"> Share link </button> </h4>RLS policies are optimized for performance: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- View query plan with RLS EXPLAIN MATCH (p:Person) WHERE p.age > 30 RETURN p; -- Output shows RLS filter integration: -- IndexScan (Person, age > 30) -- └── RLS Filter (tenant_id = 'tenant-123') -- └── Return </code></pre></div>Best Practices for RLS Performance: <ol> <li>Index columns used in RLS policies</li> <li>Use simple equality checks when possible</li> <li>Avoid complex subqueries in policies</li> <li>Test with EXPLAIN to verify index usage</li> </ol> <h3 id="permission-inheritance" class="position-relative d-flex align-items-center group"> Permission Inheritance <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="permission-inheritance" aria-haspopup="dialog" aria-label="Share link: Permission Inheritance"> Share link </button> </h3> <h4 id="graph-level-permissions" class="position-relative d-flex align-items-center group"> Graph-Level Permissions <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="graph-level-permissions" aria-haspopup="dialog" aria-label="Share link: Graph-Level Permissions"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Permission hierarchy: -- DATABASE > GRAPH > LABEL > PROPERTY -- Grant on database (all graphs) GRANT SELECT ON DATABASE geodedb TO analyst; -- Grant on graph (all labels) GRANT SELECT ON GRAPH SocialNetwork TO analyst; -- Grant on label (all properties) GRANT SELECT ON GRAPH SocialNetwork.Person TO analyst; -- Grant on property (specific columns) GRANT SELECT (name, email) ON GRAPH SocialNetwork.Person TO analyst; </code></pre></div> <h4 id="default-permissions" class="position-relative d-flex align-items-center group"> Default Permissions <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="default-permissions" aria-haspopup="dialog" aria-label="Share link: Default Permissions"> Share link </button> </h4>Configure default permissions for new objects: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-yaml" data-lang="yaml">security: authorization: default_permissions: new_graphs: ["SELECT"] # Default for new graphs new_users: ["reader"] # Default role for new users public_schema: enabled: true # Allow public schema permissions: ["SELECT"] # Public schema permissions </code></pre></div> <h3 id="effective-permissions" class="position-relative d-flex align-items-center group"> Effective Permissions <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="effective-permissions" aria-haspopup="dialog" aria-label="Share link: Effective Permissions"> Share link </button> </h3> <h4 id="viewing-effective-permissions" class="position-relative d-flex align-items-center group"> Viewing Effective Permissions <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="viewing-effective-permissions" aria-haspopup="dialog" aria-label="Share link: Viewing Effective Permissions"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Show effective permissions for current user SHOW GRANTS; -- Show permissions for specific user SHOW GRANTS FOR USER alice; -- Show permissions on specific object SHOW GRANTS ON GRAPH SocialNetwork; -- Detailed permission check EXPLAIN SECURITY MATCH (p:Person) RETURN p; -- Output: -- Permission Check for: MATCH (p:Person) RETURN p -- User: alice -- Roles: analyst, reader -- -- RBAC: -- [ALLOW] SELECT on GRAPH SocialNetwork (via role: analyst) -- -- ABAC: -- [ALLOW] dept_policy: user.department = 'Analytics' -- -- RLS: -- [FILTER] tenant_isolation: tenant_id = 'tenant-123' -- -- Effective: ALLOW with RLS filter </code></pre></div> <h4 id="permission-precedence" class="position-relative d-flex align-items-center group"> Permission Precedence <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="permission-precedence" aria-haspopup="dialog" aria-label="Share link: Permission Precedence"> Share link </button> </h4><ol> <li>Explicit DENY takes precedence over ALLOW</li> <li>More specific permissions override general permissions</li> <li>Multiple ALLOW permissions are combined (OR logic)</li> <li>RLS policies are always applied after RBAC/ABAC</li> </ol> <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Explicit deny DENY DELETE ON GRAPH SocialNetwork TO analyst; -- This overrides any ALLOW from role inheritance -- analyst cannot delete even if parent role allows it </code></pre></div> <h3 id="audit-and-compliance" class="position-relative d-flex align-items-center group"> Audit and Compliance <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="audit-and-compliance" aria-haspopup="dialog" aria-label="Share link: Audit and Compliance"> Share link </button> </h3> <h4 id="authorization-audit-events" class="position-relative d-flex align-items-center group"> Authorization Audit Events <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="authorization-audit-events" aria-haspopup="dialog" aria-label="Share link: Authorization Audit Events"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-yaml" data-lang="yaml">security: audit: authorization_events: - permission_granted - permission_revoked - role_created - role_dropped - role_assigned - role_revoked - policy_created - policy_dropped - access_denied - rls_filter_applied </code></pre></div>Sample Audit Log: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-json" data-lang="json">{ "timestamp": "2026-01-28T14:30:00.123Z", "event_type": "access_denied", "user": "bob", "action": "DELETE", "resource": "SocialNetwork.Person", "reason": "insufficient_privileges", "required": "DELETE", "actual": "SELECT, INSERT", "trace_id": "abc123..." } </code></pre></div> <h4 id="compliance-reports" class="position-relative d-flex align-items-center group"> Compliance Reports <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="compliance-reports" aria-haspopup="dialog" aria-label="Share link: Compliance Reports"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Generate access report geode admin access-report \ --user alice \ --output access-report.json # Generate permission matrix geode admin permission-matrix \ --graph SocialNetwork \ --output permissions.csv # Audit permission changes geode admin audit-log \ --event-type permission_* \ --since "2026-01-01" \ --output audit.json </code></pre></div> <h3 id="configuration-reference" class="position-relative d-flex align-items-center group"> Configuration Reference <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="configuration-reference" aria-haspopup="dialog" aria-label="Share link: Configuration Reference"> Share link </button> </h3> <h4 id="complete-authorization-configuration" class="position-relative d-flex align-items-center group"> Complete Authorization Configuration <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="complete-authorization-configuration" aria-haspopup="dialog" aria-label="Share link: Complete Authorization Configuration"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-yaml" data-lang="yaml">security: authorization: enabled: true # Default deny (require explicit grants) default_deny: true # Cache settings cache: enabled: true ttl_seconds: 300 max_entries: 10000 # RBAC settings rbac: enabled: true role_hierarchy: true # Enable role inheritance max_roles_per_user: 20 # ABAC settings abac: enabled: true policy_evaluation_order: "most_specific_first" default_policy: "deny" # RLS settings rls: enabled: true bypass_roles: # Roles that bypass RLS - admin - dba default_policy: "deny" # Deny if no policy matches </code></pre></div> <h3 id="best-practices" class="position-relative d-flex align-items-center group"> Best Practices <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="best-practices" aria-haspopup="dialog" aria-label="Share link: Best Practices"> Share link </button> </h3> <h4 id="rbac-best-practices" class="position-relative d-flex align-items-center group"> RBAC Best Practices <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="rbac-best-practices" aria-haspopup="dialog" aria-label="Share link: RBAC Best Practices"> Share link </button> </h4><ol> <li>Use roles, not user-specific permissions: Easier to manage and audit</li> <li>Create role hierarchy: Inherit common permissions</li> <li>Principle of least privilege: Grant minimum required permissions</li> <li>Regular access reviews: Audit permissions quarterly</li> <li>Document role purposes: Use COMMENT on role creation</li> </ol> <h4 id="abac-best-practices" class="position-relative d-flex align-items-center group"> ABAC Best Practices <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="abac-best-practices" aria-haspopup="dialog" aria-label="Share link: ABAC Best Practices"> Share link </button> </h4><ol> <li>Keep policies simple: Complex policies are hard to debug</li> <li>Use meaningful attribute names: Clear naming improves maintainability</li> <li>Test policies thoroughly: Verify behavior with different contexts</li> <li>Monitor policy performance: Avoid expensive computations</li> <li>Document policy rationale: Explain why each policy exists</li> </ol> <h4 id="rls-best-practices" class="position-relative d-flex align-items-center group"> RLS Best Practices <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="rls-best-practices" aria-haspopup="dialog" aria-label="Share link: RLS Best Practices"> Share link </button> </h4><ol> <li>Index RLS columns: Performance critical for large datasets</li> <li>Use tenant isolation for multi-tenancy: Standard pattern</li> <li>Test with multiple users: Verify isolation works correctly</li> <li>Consider performance impact: Simple policies perform better</li> <li>Combine with RBAC: RLS filters what RBAC allows</li> </ol> <h3 id="troubleshooting" class="position-relative d-flex align-items-center group"> Troubleshooting <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="troubleshooting" aria-haspopup="dialog" aria-label="Share link: Troubleshooting"> Share link </button> </h3> <h4 id="permission-denied" class="position-relative d-flex align-items-center group"> Permission Denied <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="permission-denied" aria-haspopup="dialog" aria-label="Share link: Permission Denied"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Check effective permissions geode query "SHOW GRANTS FOR USER alice" # Explain security check geode query "EXPLAIN SECURITY MATCH (p:Person) RETURN p" --as alice # Check role membership geode query "SHOW ROLES FOR USER alice" </code></pre></div> <h4 id="rls-not-filtering" class="position-relative d-flex align-items-center group"> RLS Not Filtering <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="rls-not-filtering" aria-haspopup="dialog" aria-label="Share link: RLS Not Filtering"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Verify RLS is enabled geode admin show-config | grep rls # Check policy exists geode query "SHOW POLICIES ON Person" # Verify session context geode query "SELECT session.tenant_id" </code></pre></div> <h4 id="policy-conflicts" class="position-relative d-flex align-items-center group"> Policy Conflicts <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="policy-conflicts" aria-haspopup="dialog" aria-label="Share link: Policy Conflicts"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># List all policies affecting type geode query "SHOW POLICIES ON :Person VERBOSE" # Check policy evaluation order geode admin policy-debug --type Person --action SELECT </code></pre></div> <h3 id="related-documentation" class="position-relative d-flex align-items-center group"> Related Documentation <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="related-documentation" aria-haspopup="dialog" aria-label="Share link: Related Documentation"> Share link </button> </h3><ul> <li><a href="/docs/security/authentication/" >Authentication</a> - Authentication mechanisms</li> <li><a href="/docs/security/overview/" >Security Overview</a> - Complete security architecture</li> <li><a href="/docs/ops/audit-logging/" >Audit Logging</a> - Authorization audit trail</li> <li><a href="/docs/security/session-management/" >Session Management</a> - Session-based context</li> <li><a href="/docs/guides/multi-datacenter/" >Multi-Datacenter Guide</a> - Distributed authorization</li> </ul>