Authorization and Access Control

Authorization in Geode provides comprehensive control over who can access your graph data and what operations they can perform. Building on authentication (verifying identity), authorization determines what authenticated users are permitted to do within the database. Geode implements a multi-layered authorization system combining role-based access control (RBAC), object-level permissions, and row-level security (RLS) to deliver enterprise-grade access management. <h3 id="authorization-architecture" class="position-relative d-flex align-items-center group"> Authorization Architecture <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="authorization-architecture" aria-haspopup="dialog" aria-label="Share link: Authorization Architecture"> Share link </button> </h3><div id="headingShareModal" class="heading-share-modal" role="dialog" aria-modal="true" aria-labelledby="headingShareTitle" hidden> <div class="hsm-dialog" role="document"> <div class="hsm-header"> <h2 id="headingShareTitle" class="h6 mb-0 fw-bold">Share this section</h2> <button type="button" class="hsm-close" aria-label="Close"> </button> </div> <div class="hsm-body"> <label for="headingShareInput" class="form-label small text-muted mb-1 text-uppercase fw-bold" style="font-size: 0.7rem; letter-spacing: 0.5px;">Permalink</label> <div class="input-group mb-4 hsm-url-group"> <input id="headingShareInput" type="text" class="form-control font-monospace" readonly aria-readonly="true" style="font-size: 0.85rem;" /> <button class="btn btn-primary hsm-copy" type="button" aria-label="Copy" title="Copy"> </button> </div> <div class="small fw-bold mb-2 text-muted text-uppercase" style="font-size: 0.7rem; letter-spacing: 0.5px;">Share via</div> <div class="hsm-share-grid"> <a id="share-twitter" class="btn btn-outline-secondary w-100" target="_blank" rel="noopener noreferrer"> Twitter </a> <a id="share-linkedin" class="btn btn-outline-secondary w-100" target="_blank" rel="noopener noreferrer"> LinkedIn </a> <a id="share-facebook" class="btn btn-outline-secondary w-100" target="_blank" rel="noopener noreferrer"> Facebook </a> </div> </div> </div> </div> <style> .heading-share-modal { position: fixed; inset: 0; display: flex; justify-content: center; align-items: center; background: rgba(0, 0, 0, 0.6); z-index: 1050; padding: 1rem; backdrop-filter: blur(4px); -webkit-backdrop-filter: blur(4px); } .heading-share-modal[hidden] { display: none !important; } .hsm-dialog { max-width: 420px; width: 100%; background: var(--bs-body-bg, #fff); color: var(--bs-body-color, #212529); border: 1px solid var(--bs-border-color, rgba(0,0,0,0.1)); border-radius: 1rem; box-shadow: 0 25px 50px -12px rgba(0, 0, 0, 0.25); overflow: hidden; animation: hsm-fade-in 0.2s ease-out; } @keyframes hsm-fade-in { from { opacity: 0; transform: scale(0.95); } to { opacity: 1; transform: scale(1); } } [data-bs-theme="dark"] .hsm-dialog { background: #1e293b; border-color: rgba(255,255,255,0.1); color: #f8f9fa; } .hsm-header { display: flex; justify-content: space-between; align-items: center; padding: 1rem 1.5rem; border-bottom: 1px solid var(--bs-border-color, rgba(0,0,0,0.1)); background: rgba(0,0,0,0.02); } [data-bs-theme="dark"] .hsm-header { background: rgba(255,255,255,0.02); border-color: rgba(255,255,255,0.1); } .hsm-close { background: transparent; border: none; color: inherit; opacity: 0.5; padding: 0.25rem 0.5rem; border-radius: 0.25rem; font-size: 1.2rem; line-height: 1; transition: opacity 0.2s; } .hsm-close:hover { opacity: 1; } .hsm-body { padding: 1.5rem; } .hsm-url-group { display: flex !important; align-items: stretch; } .hsm-url-group .form-control { flex: 1; min-width: 0; margin: 0; background: var(--bs-secondary-bg, #f8f9fa); border-color: var(--bs-border-color, #dee2e6); border-top-right-radius: 0; border-bottom-right-radius: 0; height: 42px; } .hsm-url-group .btn { flex: 0 0 auto; margin: 0; margin-left: -1px; border-top-left-radius: 0; border-bottom-left-radius: 0; height: 42px; display: flex; align-items: center; justify-content: center; padding: 0 1.25rem; z-index: 2; } [data-bs-theme="dark"] .hsm-url-group .form-control { background: #0f172a; border-color: #334155; color: #e2e8f0; } .hsm-share-grid { display: flex; flex-direction: column; gap: 0.5rem; } .hsm-share-grid .btn { display: flex; align-items: center; justify-content: center; font-size: 0.9rem; padding: 0.6rem; border-color: var(--bs-border-color); width: 100%; } [data-bs-theme="dark"] .hsm-share-grid .btn { color: #e2e8f0; border-color: #475569; } [data-bs-theme="dark"] .hsm-share-grid .btn:hover { background: #334155; border-color: #cbd5e1; } </style> <script> (function(){ const modal = document.getElementById('headingShareModal'); if(!modal) return; const input = modal.querySelector('#headingShareInput'); const copyBtn = modal.querySelector('.hsm-copy'); const twitter = modal.querySelector('#share-twitter'); const linkedin = modal.querySelector('#share-linkedin'); const facebook = modal.querySelector('#share-facebook'); const closeBtn = modal.querySelector('.hsm-close'); let lastFocus=null; let trapBound=false; function buildUrl(id){ return window.location.origin + window.location.pathname + '#' + id; } function isOpen(){ return !modal.hasAttribute('hidden'); } function hydrate(id){ const url=buildUrl(id); input.value=url; const enc=encodeURIComponent(url); const text=encodeURIComponent(document.title); if(twitter) twitter.href=`https://twitter.com/intent/tweet?url=${enc}&text=${text}`; if(linkedin) linkedin.href=`https://www.linkedin.com/sharing/share-offsite/?url=${enc}`; if(facebook) facebook.href=`https://www.facebook.com/sharer/sharer.php?u=${enc}`; } function openModal(id){ lastFocus=document.activeElement; hydrate(id); if(!isOpen()){ modal.removeAttribute('hidden'); } requestAnimationFrame(()=>{ input.focus(); }); trapFocus(); } function closeModal(){ if(!isOpen()) return; modal.setAttribute('hidden',''); if(lastFocus && typeof lastFocus.focus==='function') lastFocus.focus(); } function copyCurrent(){ try{ navigator.clipboard.writeText(input.value).then(()=>feedback(true),()=>fallback()); } catch(e){ fallback(); } } function fallback(){ input.select(); try{ document.execCommand('copy'); feedback(true);}catch(e){ feedback(false);} } function feedback(ok){ if(!copyBtn) return; const icon=copyBtn.querySelector('i'); if(!icon) return; const prev=copyBtn.getAttribute('data-prev')||icon.className; if(!copyBtn.getAttribute('data-prev')) copyBtn.setAttribute('data-prev',prev); icon.className= ok ? 'fa-duotone fa-clipboard-check':'fa-duotone fa-circle-exclamation'; setTimeout(()=>{ icon.className=prev; },1800); } function handleShareClick(e){ e.preventDefault(); const btn=e.currentTarget; const id=btn.getAttribute('data-share-target'); if(id) openModal(id); } function bindShareButtons(){ document.querySelectorAll('.h-share').forEach(btn=>{ if(!btn.dataset.hShareBound){ btn.addEventListener('click', handleShareClick); btn.dataset.hShareBound='1'; } }); } bindShareButtons(); if(document.readyState==='loading'){ document.addEventListener('DOMContentLoaded', bindShareButtons); } else { requestAnimationFrame(bindShareButtons); } document.addEventListener('click', function(e){ const shareBtn=e.target.closest && e.target.closest('.h-share'); if(shareBtn && !shareBtn.dataset.hShareBound){ handleShareClick.call(shareBtn, e); } }, true); document.addEventListener('click', e=>{ if(e.target===modal) closeModal(); if(e.target.closest && e.target.closest('.hsm-close')){ e.preventDefault(); closeModal(); } if(copyBtn && (e.target===copyBtn || (e.target.closest && e.target.closest('.hsm-copy')))) { e.preventDefault(); copyCurrent(); } }); document.addEventListener('keydown', e=>{ if(e.key==='Escape' && isOpen()) closeModal(); }); function trapFocus(){ if(trapBound) return; trapBound=true; modal.addEventListener('keydown', f=>{ if(f.key==='Tab' && isOpen()){ const focusable=[...modal.querySelectorAll('a[href],button,input,textarea,select,[tabindex]:not([tabindex="-1"])')].filter(el=>!el.hasAttribute('disabled')); if(!focusable.length) return; const first=focusable[0]; const last=focusable[focusable.length-1]; if(f.shiftKey && document.activeElement===first){ f.preventDefault(); last.focus(); } else if(!f.shiftKey && document.activeElement===last){ f.preventDefault(); first.focus(); } } }); } if(closeBtn) closeBtn.addEventListener('click', e=>{ e.preventDefault(); closeModal(); }); })(); </script>Geode’s authorization system operates at multiple levels to provide defense-in-depth: <ul> <li>System Level: Controls server administration, user management, and global operations</li> <li>Graph Level: Controls access to entire graphs (create, read, write, delete)</li> <li>Label Level: Controls access to specific node and relationship types</li> <li>Property Level: Controls access to individual properties within nodes and relationships</li> <li>Row Level: Controls access to specific data rows based on runtime conditions</li> </ul> Authorization decisions are evaluated in order, with more specific rules taking precedence over general rules. <h3 id="permission-types" class="position-relative d-flex align-items-center group"> Permission Types <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="permission-types" aria-haspopup="dialog" aria-label="Share link: Permission Types"> Share link </button> </h3>Geode supports the following permission types: <h4 id="data-permissions" class="position-relative d-flex align-items-center group"> Data Permissions <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="data-permissions" aria-haspopup="dialog" aria-label="Share link: Data Permissions"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- SELECT: Read data from nodes, relationships, and properties GRANT SELECT ON GRAPH social_network TO analyst; -- INSERT: Create new nodes and relationships GRANT INSERT ON :User TO application_service; -- UPDATE: Modify existing properties GRANT UPDATE ON :User TO user_management; -- DELETE: Remove nodes, relationships, or properties GRANT DELETE ON :TempData TO cleanup_service; -- MERGE: Create or update data (combines INSERT and UPDATE) GRANT MERGE ON :Session TO session_manager; </code></pre></div> <h4 id="schema-permissions" class="position-relative d-flex align-items-center group"> Schema Permissions <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="schema-permissions" aria-haspopup="dialog" aria-label="Share link: Schema Permissions"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- CREATE: Create new graphs, labels, or constraints GRANT CREATE GRAPH TO schema_admin; GRANT CREATE CONSTRAINT TO developer; -- ALTER: Modify schema definitions GRANT ALTER ON GRAPH analytics TO data_architect; -- DROP: Remove schema elements GRANT DROP CONSTRAINT TO schema_admin; </code></pre></div> <h4 id="administrative-permissions" class="position-relative d-flex align-items-center group"> Administrative Permissions <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="administrative-permissions" aria-haspopup="dialog" aria-label="Share link: Administrative Permissions"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- ADMIN: Full administrative access GRANT ADMIN ON DATABASE TO dba_team; -- EXECUTE: Execute stored procedures and functions GRANT EXECUTE ON PROCEDURE export_data TO analyst; -- BACKUP: Create and restore backups GRANT BACKUP ON DATABASE TO backup_service; </code></pre></div> <h3 id="granting-permissions" class="position-relative d-flex align-items-center group"> Granting Permissions <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="granting-permissions" aria-haspopup="dialog" aria-label="Share link: Granting Permissions"> Share link </button> </h3>Permissions are granted using the <code>GRANT</code> statement. Permissions can be granted to users directly or to roles (recommended). <h4 id="basic-grant-syntax" class="position-relative d-flex align-items-center group"> Basic Grant Syntax <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="basic-grant-syntax" aria-haspopup="dialog" aria-label="Share link: Basic Grant Syntax"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Grant to a user GRANT SELECT ON GRAPH customers TO alice; -- Grant to a role GRANT SELECT, INSERT ON GRAPH customers TO data_entry; -- Grant multiple permissions at once GRANT SELECT, INSERT, UPDATE, DELETE ON GRAPH inventory TO warehouse_manager; </code></pre></div> <h4 id="granting-with-grant-option" class="position-relative d-flex align-items-center group"> Granting with Grant Option <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="granting-with-grant-option" aria-haspopup="dialog" aria-label="Share link: Granting with Grant Option"> Share link </button> </h4>Allow recipients to further grant the permission to others: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Alice can grant SELECT to other users GRANT SELECT ON GRAPH customers TO alice WITH GRANT OPTION; -- Team lead can delegate permissions GRANT INSERT ON :Order TO team_lead WITH GRANT OPTION; </code></pre></div> <h4 id="granting-all-permissions" class="position-relative d-flex align-items-center group"> Granting All Permissions <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="granting-all-permissions" aria-haspopup="dialog" aria-label="Share link: Granting All Permissions"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Grant all data permissions on a graph GRANT ALL ON GRAPH analytics TO data_scientist; -- Grant all permissions on specific labels GRANT ALL ON :Product, :Category TO product_manager; </code></pre></div> <h3 id="denying-permissions" class="position-relative d-flex align-items-center group"> Denying Permissions <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="denying-permissions" aria-haspopup="dialog" aria-label="Share link: Denying Permissions"> Share link </button> </h3>The <code>DENY</code> statement explicitly prevents access, overriding any granted permissions: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Prevent access to sensitive data DENY SELECT ON :Salary TO general_employee; -- Block modification of historical records DENY UPDATE, DELETE ON :AuditLog TO ROLE application; -- Deny specific property access DENY SELECT(ssn, credit_score) ON :Customer TO marketing; </code></pre></div> <h4 id="deny-precedence" class="position-relative d-flex align-items-center group"> Deny Precedence <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="deny-precedence" aria-haspopup="dialog" aria-label="Share link: Deny Precedence"> Share link </button> </h4>Deny rules take precedence over grant rules at the same specificity level: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- User has analyst role with broad SELECT GRANT ROLE analyst TO bob; GRANT SELECT ON GRAPH company TO analyst; -- But Bob specifically cannot see salary data DENY SELECT(salary) ON :Employee TO bob; -- Bob can read employees but not their salaries </code></pre></div> <h3 id="revoking-permissions" class="position-relative d-flex align-items-center group"> Revoking Permissions <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="revoking-permissions" aria-haspopup="dialog" aria-label="Share link: Revoking Permissions"> Share link </button> </h3>Remove previously granted permissions: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Revoke specific permission REVOKE SELECT ON GRAPH customers FROM alice; -- Revoke multiple permissions REVOKE INSERT, UPDATE ON :Order FROM data_entry; -- Revoke grant option only (keeps the permission) REVOKE GRANT OPTION FOR SELECT ON GRAPH customers FROM alice; -- Revoke all permissions from user/role REVOKE ALL ON GRAPH analytics FROM consultant; </code></pre></div> <h3 id="label-level-authorization" class="position-relative d-flex align-items-center group"> Label-Level Authorization <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="label-level-authorization" aria-haspopup="dialog" aria-label="Share link: Label-Level Authorization"> Share link </button> </h3>Control access to specific node and relationship types: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Different teams access different node types GRANT SELECT ON :Customer TO sales_team; GRANT SELECT ON :Product TO inventory_team; GRANT SELECT ON :Employee TO hr_team; -- Relationship type permissions GRANT SELECT ON :PURCHASED TO analytics; GRANT INSERT ON :FOLLOWS TO social_features; -- Restrict access to sensitive labels DENY SELECT ON :InternalMemo TO external_contractor; </code></pre></div> <h4 id="pattern-based-label-permissions" class="position-relative d-flex align-items-center group"> Pattern-Based Label Permissions <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="pattern-based-label-permissions" aria-haspopup="dialog" aria-label="Share link: Pattern-Based Label Permissions"> Share link </button> </h4>Use wildcards for managing permissions across multiple labels: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Grant access to all Public* labels GRANT SELECT ON :Public* TO public_api; -- Grant access to all labels in a namespace GRANT SELECT ON :hr_* TO hr_department; -- Deny access to all Internal* labels DENY SELECT ON :Internal* TO external_user; </code></pre></div> <h3 id="property-level-authorization" class="position-relative d-flex align-items-center group"> Property-Level Authorization <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="property-level-authorization" aria-haspopup="dialog" aria-label="Share link: Property-Level Authorization"> Share link </button> </h3>Fine-grained control over individual properties: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Grant access to specific properties only GRANT SELECT(name, email, department) ON :Employee TO directory_service; -- Hide sensitive properties DENY SELECT(salary, performance_rating, ssn) ON :Employee TO general_user; -- Allow updating specific properties GRANT UPDATE(email, phone, address) ON :Employee TO self_service; -- Block modification of system properties DENY UPDATE(created_at, created_by, internal_id) ON :* TO application; </code></pre></div> <h4 id="column-masking" class="position-relative d-flex align-items-center group"> Column Masking <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="column-masking" aria-haspopup="dialog" aria-label="Share link: Column Masking"> Share link </button> </h4>Automatically mask sensitive data for unauthorized users: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Create masking policy for credit cards CREATE MASK credit_card_mask ON :Payment.card_number AS CASE WHEN current_user_has_role('pci_admin') THEN card_number ELSE '****-****-****-' || right(card_number, 4) END; -- Apply masking to SSN CREATE MASK ssn_mask ON :Person.ssn AS CASE WHEN current_user_has_role('hr_admin') THEN ssn ELSE '***-**-' || right(ssn, 4) END; </code></pre></div> <h3 id="graph-level-authorization" class="position-relative d-flex align-items-center group"> Graph-Level Authorization <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="graph-level-authorization" aria-haspopup="dialog" aria-label="Share link: Graph-Level Authorization"> Share link </button> </h3>Control access to entire graphs: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Grant read access to a graph GRANT SELECT ON GRAPH production TO reporting; -- Grant full access to development graph GRANT ALL ON GRAPH development TO developers; -- Prevent access to sensitive graph DENY ALL ON GRAPH executive_compensation TO general_employee; -- Control graph management GRANT CREATE GRAPH TO data_architect; GRANT DROP GRAPH TO dba; </code></pre></div> <h4 id="multi-graph-authorization" class="position-relative d-flex align-items-center group"> Multi-Graph Authorization <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="multi-graph-authorization" aria-haspopup="dialog" aria-label="Share link: Multi-Graph Authorization"> Share link </button> </h4>When working with multiple graphs: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Grant access to multiple graphs GRANT SELECT ON GRAPH customers, orders, inventory TO fulfillment; -- Different permission levels per graph GRANT SELECT ON GRAPH production TO analyst; GRANT ALL ON GRAPH analytics TO analyst; -- Cross-graph query permissions GRANT SELECT ON GRAPH * TO global_reporting; </code></pre></div> <h3 id="authorization-with-stored-procedures" class="position-relative d-flex align-items-center group"> Authorization with Stored Procedures <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="authorization-with-stored-procedures" aria-haspopup="dialog" aria-label="Share link: Authorization with Stored Procedures"> Share link </button> </h3>Control execution of stored procedures and functions: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Grant execute permission GRANT EXECUTE ON PROCEDURE calculate_recommendations TO recommendation_engine; -- Grant with elevated privileges CREATE PROCEDURE admin_task() SECURITY DEFINER -- Runs with creator's privileges AS $$ MATCH (u:User) WHERE u.inactive FOR '365 days' DETACH DELETE u $$; -- Grant to run procedures with caller's privileges CREATE PROCEDURE user_report(user_id: STRING) SECURITY INVOKER -- Runs with caller's privileges AS $$ MATCH (u:User {id: $user_id}) RETURN u $$; </code></pre></div> <h3 id="dynamic-authorization" class="position-relative d-flex align-items-center group"> Dynamic Authorization <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="dynamic-authorization" aria-haspopup="dialog" aria-label="Share link: Dynamic Authorization"> Share link </button> </h3>Authorization decisions that depend on runtime context: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Time-based access control CREATE POLICY business_hours_only ON :Transaction FOR ALL TO standard_user USING (EXTRACT(HOUR FROM current_timestamp()) BETWEEN 9 AND 17); -- Location-based access CREATE POLICY regional_access ON :Customer FOR SELECT TO regional_manager USING (c.region = current_user_property('assigned_region')); -- Data classification-based access CREATE POLICY classification_access ON :Document FOR SELECT TO analyst USING (d.classification_level <= current_user_property('clearance_level')); </code></pre></div> <h3 id="authorization-inheritance" class="position-relative d-flex align-items-center group"> Authorization Inheritance <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="authorization-inheritance" aria-haspopup="dialog" aria-label="Share link: Authorization Inheritance"> Share link </button> </h3> <h4 id="role-hierarchy" class="position-relative d-flex align-items-center group"> Role Hierarchy <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="role-hierarchy" aria-haspopup="dialog" aria-label="Share link: Role Hierarchy"> Share link </button> </h4>Roles can inherit from other roles: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Create base role CREATE ROLE employee; GRANT SELECT ON :PublicInfo TO employee; -- Create role that inherits from employee CREATE ROLE manager INHERITS employee; GRANT SELECT ON :TeamPerformance TO manager; -- Managers automatically have employee permissions plus their own </code></pre></div> <h4 id="permission-inheritance-chain" class="position-relative d-flex align-items-center group"> Permission Inheritance Chain <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="permission-inheritance-chain" aria-haspopup="dialog" aria-label="Share link: Permission Inheritance Chain"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Build inheritance chain CREATE ROLE viewer; CREATE ROLE editor INHERITS viewer; CREATE ROLE admin INHERITS editor; -- Assign permissions at appropriate levels GRANT SELECT ON GRAPH main TO viewer; GRANT INSERT, UPDATE ON GRAPH main TO editor; GRANT DELETE, ADMIN ON GRAPH main TO admin; -- Admin has all permissions: SELECT, INSERT, UPDATE, DELETE, ADMIN </code></pre></div> <h3 id="viewing-authorization" class="position-relative d-flex align-items-center group"> Viewing Authorization <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="viewing-authorization" aria-haspopup="dialog" aria-label="Share link: Viewing Authorization"> Share link </button> </h3> <h4 id="check-current-permissions" class="position-relative d-flex align-items-center group"> Check Current Permissions <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="check-current-permissions" aria-haspopup="dialog" aria-label="Share link: Check Current Permissions"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Show permissions for current user SHOW GRANTS FOR CURRENT USER; -- Show permissions for specific user SHOW GRANTS FOR alice; -- Show permissions for a role SHOW GRANTS FOR ROLE analyst; -- Show effective permissions (including inherited) SHOW EFFECTIVE GRANTS FOR bob; </code></pre></div> <h4 id="system-views" class="position-relative d-flex align-items-center group"> System Views <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="system-views" aria-haspopup="dialog" aria-label="Share link: System Views"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- View all permission grants SELECT * FROM system.privileges WHERE grantee = 'analyst'; -- View role memberships SELECT * FROM system.role_members WHERE member = 'alice'; -- View all deny rules SELECT * FROM system.privileges WHERE is_deny = true; </code></pre></div> <h3 id="authorization-best-practices" class="position-relative d-flex align-items-center group"> Authorization Best Practices <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="authorization-best-practices" aria-haspopup="dialog" aria-label="Share link: Authorization Best Practices"> Share link </button> </h3> <h4 id="1-use-role-based-access-control" class="position-relative d-flex align-items-center group"> 1. Use Role-Based Access Control <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="1-use-role-based-access-control" aria-haspopup="dialog" aria-label="Share link: 1. Use Role-Based Access Control"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- DO: Grant to roles, assign roles to users CREATE ROLE report_viewer; GRANT SELECT ON GRAPH reports TO report_viewer; GRANT ROLE report_viewer TO alice, bob, charlie; -- DON'T: Grant directly to users -- GRANT SELECT ON GRAPH reports TO alice; -- GRANT SELECT ON GRAPH reports TO bob; -- GRANT SELECT ON GRAPH reports TO charlie; </code></pre></div> <h4 id="2-implement-least-privilege" class="position-relative d-flex align-items-center group"> 2. Implement Least Privilege <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="2-implement-least-privilege" aria-haspopup="dialog" aria-label="Share link: 2. Implement Least Privilege"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Start with no permissions CREATE USER new_analyst; -- Grant only what's needed GRANT SELECT ON GRAPH analytics TO new_analyst; GRANT SELECT(name, email, department) ON :Employee TO new_analyst; -- Review and adjust as needed SHOW GRANTS FOR new_analyst; </code></pre></div> <h4 id="3-use-deny-for-explicit-restrictions" class="position-relative d-flex align-items-center group"> 3. Use Deny for Explicit Restrictions <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="3-use-deny-for-explicit-restrictions" aria-haspopup="dialog" aria-label="Share link: 3. Use Deny for Explicit Restrictions"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Broad grant with specific deny GRANT SELECT ON GRAPH company TO analyst; DENY SELECT ON :Salary TO analyst; DENY SELECT ON :ExecutiveCompensation TO analyst; </code></pre></div> <h4 id="4-regular-permission-audits" class="position-relative d-flex align-items-center group"> 4. Regular Permission Audits <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="4-regular-permission-audits" aria-haspopup="dialog" aria-label="Share link: 4. Regular Permission Audits"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Find users with admin privileges SELECT grantee FROM system.privileges WHERE privilege = 'ADMIN'; -- Find unused permissions SELECT p.grantee, p.privilege, p.object_name FROM system.privileges p LEFT JOIN system.access_log a ON p.grantee = a.username AND p.object_name = a.object_name WHERE a.last_access IS NULL OR a.last_access < current_timestamp() - INTERVAL '90 days'; </code></pre></div> <h4 id="5-separate-development-and-production" class="position-relative d-flex align-items-center group"> 5. Separate Development and Production <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="5-separate-development-and-production" aria-haspopup="dialog" aria-label="Share link: 5. Separate Development and Production"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Production: Minimal permissions GRANT SELECT ON GRAPH production TO application; -- Development: Broader permissions GRANT ALL ON GRAPH development TO developer; -- Prevent production modification from dev accounts DENY INSERT, UPDATE, DELETE ON GRAPH production TO developer; </code></pre></div> <h3 id="authorization-configuration" class="position-relative d-flex align-items-center group"> Authorization Configuration <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="authorization-configuration" aria-haspopup="dialog" aria-label="Share link: Authorization Configuration"> Share link </button> </h3> <h4 id="server-level-settings" class="position-relative d-flex align-items-center group"> Server-Level Settings <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="server-level-settings" aria-haspopup="dialog" aria-label="Share link: Server-Level Settings"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Enable authorization enforcement geode serve --authorization-enabled=true # Set default deny (no implicit permissions) geode serve --default-deny=true # Enable permission caching for performance geode serve --permission-cache-size=10000 \ --permission-cache-ttl=300s # Log all authorization decisions geode serve --log-authorization=true </code></pre></div> <h4 id="configuration-file" class="position-relative d-flex align-items-center group"> Configuration File <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="configuration-file" aria-haspopup="dialog" aria-label="Share link: Configuration File"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-yaml" data-lang="yaml"># geode.yaml authorization: enabled: true default_deny: true permission_cache: enabled: true size: 10000 ttl_seconds: 300 audit: log_grants: true log_denies: true log_checks: false # Can be verbose </code></pre></div> <h3 id="troubleshooting-authorization" class="position-relative d-flex align-items-center group"> Troubleshooting Authorization <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="troubleshooting-authorization" aria-haspopup="dialog" aria-label="Share link: Troubleshooting Authorization"> Share link </button> </h3> <h4 id="permission-denied-errors" class="position-relative d-flex align-items-center group"> Permission Denied Errors <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="permission-denied-errors" aria-haspopup="dialog" aria-label="Share link: Permission Denied Errors"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Check user's current permissions SHOW GRANTS FOR current_user(); -- Check effective permissions including inheritance SHOW EFFECTIVE GRANTS FOR alice; -- Check for deny rules SELECT * FROM system.privileges WHERE grantee IN (SELECT role FROM system.role_members WHERE member = 'alice') AND is_deny = true; </code></pre></div> <h4 id="debugging-authorization" class="position-relative d-flex align-items-center group"> Debugging Authorization <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="debugging-authorization" aria-haspopup="dialog" aria-label="Share link: Debugging Authorization"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Enable verbose authorization logging geode serve --authorization-debug=true # Log shows: # [AUTH] User alice checking SELECT on :Customer # [AUTH] Found grant via role analyst # [AUTH] No deny rules match # [AUTH] Authorization: ALLOW </code></pre></div> <h4 id="common-issues" class="position-relative d-flex align-items-center group"> Common Issues <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="common-issues" aria-haspopup="dialog" aria-label="Share link: Common Issues"> Share link </button> </h4><ol> <li>Inherited deny blocking access: Check parent roles for deny rules</li> <li>Missing role assignment: Verify user has required roles</li> <li>Property-level deny: Check for property restrictions</li> <li>Graph-level restriction: Verify graph access before label access</li> </ol> <h3 id="authorization-patterns" class="position-relative d-flex align-items-center group"> Authorization Patterns <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="authorization-patterns" aria-haspopup="dialog" aria-label="Share link: Authorization Patterns"> Share link </button> </h3> <h4 id="multi-tenant-authorization" class="position-relative d-flex align-items-center group"> Multi-Tenant Authorization <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="multi-tenant-authorization" aria-haspopup="dialog" aria-label="Share link: Multi-Tenant Authorization"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Isolate tenant data CREATE POLICY tenant_isolation ON :* FOR ALL TO application USING (tenant_id = current_user_property('tenant_id')); -- Tenant admins see their own tenant only CREATE POLICY tenant_admin_access ON :User FOR ALL TO tenant_admin USING (tenant_id = current_user_property('tenant_id')); </code></pre></div> <h4 id="hierarchical-data-access" class="position-relative d-flex align-items-center group"> Hierarchical Data Access <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="hierarchical-data-access" aria-haspopup="dialog" aria-label="Share link: Hierarchical Data Access"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Manager sees direct reports CREATE POLICY manager_sees_reports ON :Employee FOR SELECT TO manager USING (manager_id = current_user_property('employee_id') OR employee_id = current_user_property('employee_id')); -- Executive sees entire organization GRANT SELECT ON :Employee TO executive; </code></pre></div> <h4 id="time-limited-access" class="position-relative d-flex align-items-center group"> Time-Limited Access <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="time-limited-access" aria-haspopup="dialog" aria-label="Share link: Time-Limited Access"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Temporary elevated access GRANT SELECT ON :AuditData TO auditor VALID UNTIL '2026-03-31'; -- Audit-period access CREATE POLICY audit_window ON :FinancialRecord FOR SELECT TO auditor USING (record_date BETWEEN '2025-01-01' AND '2025-12-31'); </code></pre></div> <h3 id="related-topics" class="position-relative d-flex align-items-center group"> Related Topics <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="related-topics" aria-haspopup="dialog" aria-label="Share link: Related Topics"> Share link </button> </h3><ul> <li><a href="/tags/rbac/" >Role-Based Access Control</a> - RBAC implementation details</li> <li><a href="/tags/rls/" >Row-Level Security</a> - Fine-grained row-level access policies</li> <li><a href="/tags/authentication/" >Authentication</a> - User identity verification</li> <li><a href="/tags/audit-logging/" >Audit Logging</a> - Tracking authorization decisions</li> <li><a href="/tags/compliance/" >Compliance</a> - Regulatory compliance requirements</li> <li><a href="/tags/security/" >Security</a> - Security overview and best practices</li> </ul> <h3 id="further-reading" class="position-relative d-flex align-items-center group"> Further Reading <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="further-reading" aria-haspopup="dialog" aria-label="Share link: Further Reading"> Share link </button> </h3><ul> <li><a href="/docs/architecture/security-architecture/" >Security Architecture</a> - Deep dive into security design</li> <li><a href="/docs/security/authorization/" >Authorization Best Practices</a> - Production deployment guide</li> <li><a href="/docs/security/session-management/" >Session Management</a> - Session and context security</li> <li>Enterprise Security Whitepaper - Comprehensive security documentation</li> </ul>

Popular

Related Articles

Authorization