Role-Based Access Control (RBAC)

Role-Based Access Control (RBAC) is the foundation of Geode’s authorization system, providing a structured approach to managing permissions through roles rather than direct user grants. RBAC simplifies permission management, improves security consistency, and enables scalable access control for organizations of any size. <h3 id="rbac-fundamentals" class="position-relative d-flex align-items-center group"> RBAC Fundamentals <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="rbac-fundamentals" aria-haspopup="dialog" aria-label="Share link: RBAC Fundamentals"> Share link </button> </h3><div id="headingShareModal" class="heading-share-modal" role="dialog" aria-modal="true" aria-labelledby="headingShareTitle" hidden> <div class="hsm-dialog" role="document"> <div class="hsm-header"> <h2 id="headingShareTitle" class="h6 mb-0 fw-bold">Share this section</h2> <button type="button" class="hsm-close" aria-label="Close"> </button> </div> <div class="hsm-body"> <label for="headingShareInput" class="form-label small text-muted mb-1 text-uppercase fw-bold" style="font-size: 0.7rem; letter-spacing: 0.5px;">Permalink</label> <div class="input-group mb-4 hsm-url-group"> <input id="headingShareInput" type="text" class="form-control font-monospace" readonly aria-readonly="true" style="font-size: 0.85rem;" /> <button class="btn btn-primary hsm-copy" type="button" aria-label="Copy" title="Copy"> </button> </div> <div class="small fw-bold mb-2 text-muted text-uppercase" style="font-size: 0.7rem; letter-spacing: 0.5px;">Share via</div> <div class="hsm-share-grid"> <a id="share-twitter" class="btn btn-outline-secondary w-100" target="_blank" rel="noopener noreferrer"> Twitter </a> <a id="share-linkedin" class="btn btn-outline-secondary w-100" target="_blank" rel="noopener noreferrer"> LinkedIn </a> <a id="share-facebook" class="btn btn-outline-secondary w-100" target="_blank" rel="noopener noreferrer"> Facebook </a> </div> </div> </div> </div> <style> .heading-share-modal { position: fixed; inset: 0; display: flex; justify-content: center; align-items: center; background: rgba(0, 0, 0, 0.6); z-index: 1050; padding: 1rem; backdrop-filter: blur(4px); -webkit-backdrop-filter: blur(4px); } .heading-share-modal[hidden] { display: none !important; } .hsm-dialog { max-width: 420px; width: 100%; background: var(--bs-body-bg, #fff); color: var(--bs-body-color, #212529); border: 1px solid var(--bs-border-color, rgba(0,0,0,0.1)); border-radius: 1rem; box-shadow: 0 25px 50px -12px rgba(0, 0, 0, 0.25); overflow: hidden; animation: hsm-fade-in 0.2s ease-out; } @keyframes hsm-fade-in { from { opacity: 0; transform: scale(0.95); } to { opacity: 1; transform: scale(1); } } [data-bs-theme="dark"] .hsm-dialog { background: #1e293b; border-color: rgba(255,255,255,0.1); color: #f8f9fa; } .hsm-header { display: flex; justify-content: space-between; align-items: center; padding: 1rem 1.5rem; border-bottom: 1px solid var(--bs-border-color, rgba(0,0,0,0.1)); background: rgba(0,0,0,0.02); } [data-bs-theme="dark"] .hsm-header { background: rgba(255,255,255,0.02); border-color: rgba(255,255,255,0.1); } .hsm-close { background: transparent; border: none; color: inherit; opacity: 0.5; padding: 0.25rem 0.5rem; border-radius: 0.25rem; font-size: 1.2rem; line-height: 1; transition: opacity 0.2s; } .hsm-close:hover { opacity: 1; } .hsm-body { padding: 1.5rem; } .hsm-url-group { display: flex !important; align-items: stretch; } .hsm-url-group .form-control { flex: 1; min-width: 0; margin: 0; background: var(--bs-secondary-bg, #f8f9fa); border-color: var(--bs-border-color, #dee2e6); border-top-right-radius: 0; border-bottom-right-radius: 0; height: 42px; } .hsm-url-group .btn { flex: 0 0 auto; margin: 0; margin-left: -1px; border-top-left-radius: 0; border-bottom-left-radius: 0; height: 42px; display: flex; align-items: center; justify-content: center; padding: 0 1.25rem; z-index: 2; } [data-bs-theme="dark"] .hsm-url-group .form-control { background: #0f172a; border-color: #334155; color: #e2e8f0; } .hsm-share-grid { display: flex; flex-direction: column; gap: 0.5rem; } .hsm-share-grid .btn { display: flex; align-items: center; justify-content: center; font-size: 0.9rem; padding: 0.6rem; border-color: var(--bs-border-color); width: 100%; } [data-bs-theme="dark"] .hsm-share-grid .btn { color: #e2e8f0; border-color: #475569; } [data-bs-theme="dark"] .hsm-share-grid .btn:hover { background: #334155; border-color: #cbd5e1; } </style> <script> (function(){ const modal = document.getElementById('headingShareModal'); if(!modal) return; const input = modal.querySelector('#headingShareInput'); const copyBtn = modal.querySelector('.hsm-copy'); const twitter = modal.querySelector('#share-twitter'); const linkedin = modal.querySelector('#share-linkedin'); const facebook = modal.querySelector('#share-facebook'); const closeBtn = modal.querySelector('.hsm-close'); let lastFocus=null; let trapBound=false; function buildUrl(id){ return window.location.origin + window.location.pathname + '#' + id; } function isOpen(){ return !modal.hasAttribute('hidden'); } function hydrate(id){ const url=buildUrl(id); input.value=url; const enc=encodeURIComponent(url); const text=encodeURIComponent(document.title); if(twitter) twitter.href=`https://twitter.com/intent/tweet?url=${enc}&text=${text}`; if(linkedin) linkedin.href=`https://www.linkedin.com/sharing/share-offsite/?url=${enc}`; if(facebook) facebook.href=`https://www.facebook.com/sharer/sharer.php?u=${enc}`; } function openModal(id){ lastFocus=document.activeElement; hydrate(id); if(!isOpen()){ modal.removeAttribute('hidden'); } requestAnimationFrame(()=>{ input.focus(); }); trapFocus(); } function closeModal(){ if(!isOpen()) return; modal.setAttribute('hidden',''); if(lastFocus && typeof lastFocus.focus==='function') lastFocus.focus(); } function copyCurrent(){ try{ navigator.clipboard.writeText(input.value).then(()=>feedback(true),()=>fallback()); } catch(e){ fallback(); } } function fallback(){ input.select(); try{ document.execCommand('copy'); feedback(true);}catch(e){ feedback(false);} } function feedback(ok){ if(!copyBtn) return; const icon=copyBtn.querySelector('i'); if(!icon) return; const prev=copyBtn.getAttribute('data-prev')||icon.className; if(!copyBtn.getAttribute('data-prev')) copyBtn.setAttribute('data-prev',prev); icon.className= ok ? 'fa-duotone fa-clipboard-check':'fa-duotone fa-circle-exclamation'; setTimeout(()=>{ icon.className=prev; },1800); } function handleShareClick(e){ e.preventDefault(); const btn=e.currentTarget; const id=btn.getAttribute('data-share-target'); if(id) openModal(id); } function bindShareButtons(){ document.querySelectorAll('.h-share').forEach(btn=>{ if(!btn.dataset.hShareBound){ btn.addEventListener('click', handleShareClick); btn.dataset.hShareBound='1'; } }); } bindShareButtons(); if(document.readyState==='loading'){ document.addEventListener('DOMContentLoaded', bindShareButtons); } else { requestAnimationFrame(bindShareButtons); } document.addEventListener('click', function(e){ const shareBtn=e.target.closest && e.target.closest('.h-share'); if(shareBtn && !shareBtn.dataset.hShareBound){ handleShareClick.call(shareBtn, e); } }, true); document.addEventListener('click', e=>{ if(e.target===modal) closeModal(); if(e.target.closest && e.target.closest('.hsm-close')){ e.preventDefault(); closeModal(); } if(copyBtn && (e.target===copyBtn || (e.target.closest && e.target.closest('.hsm-copy')))) { e.preventDefault(); copyCurrent(); } }); document.addEventListener('keydown', e=>{ if(e.key==='Escape' && isOpen()) closeModal(); }); function trapFocus(){ if(trapBound) return; trapBound=true; modal.addEventListener('keydown', f=>{ if(f.key==='Tab' && isOpen()){ const focusable=[...modal.querySelectorAll('a[href],button,input,textarea,select,[tabindex]:not([tabindex="-1"])')].filter(el=>!el.hasAttribute('disabled')); if(!focusable.length) return; const first=focusable[0]; const last=focusable[focusable.length-1]; if(f.shiftKey && document.activeElement===first){ f.preventDefault(); last.focus(); } else if(!f.shiftKey && document.activeElement===last){ f.preventDefault(); first.focus(); } } }); } if(closeBtn) closeBtn.addEventListener('click', e=>{ e.preventDefault(); closeModal(); }); })(); </script>RBAC operates on three core concepts: <ol> <li>Users: Individual accounts that authenticate to the database</li> <li>Roles: Named collections of permissions</li> <li>Permissions: Specific capabilities to perform operations</li> </ol> Users are assigned to roles, and roles are granted permissions. This separation allows administrators to manage access for groups of users efficiently rather than maintaining individual permissions for each user. <h3 id="benefits-of-rbac" class="position-relative d-flex align-items-center group"> Benefits of RBAC <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="benefits-of-rbac" aria-haspopup="dialog" aria-label="Share link: Benefits of RBAC"> Share link </button> </h3><ul> <li>Simplified Administration: Manage permissions for groups rather than individuals</li> <li>Consistency: All users with the same role have identical permissions</li> <li>Audit Compliance: Clear documentation of who has access to what</li> <li>Least Privilege: Easier to implement and maintain minimal access</li> <li>Scalability: Add users to roles without modifying permission grants</li> <li>Reduced Errors: Fewer permission changes means fewer mistakes</li> </ul> <h3 id="creating-roles" class="position-relative d-flex align-items-center group"> Creating Roles <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="creating-roles" aria-haspopup="dialog" aria-label="Share link: Creating Roles"> Share link </button> </h3> <h4 id="basic-role-creation" class="position-relative d-flex align-items-center group"> Basic Role Creation <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="basic-role-creation" aria-haspopup="dialog" aria-label="Share link: Basic Role Creation"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Create a simple role CREATE ROLE data_analyst; -- Create a role with description CREATE ROLE data_engineer DESCRIPTION 'Full access to ETL pipelines and data transformation'; -- Create a role with specific attributes CREATE ROLE temp_contractor DESCRIPTION 'Temporary contractor access' VALID UNTIL '2026-06-30' MAX_CONNECTIONS 5; </code></pre></div> <h4 id="system-roles" class="position-relative d-flex align-items-center group"> System Roles <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="system-roles" aria-haspopup="dialog" aria-label="Share link: System Roles"> Share link </button> </h4>Geode includes built-in system roles: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- View system roles SHOW SYSTEM ROLES; -- System roles include: -- public - Automatically granted to all users -- admin - Full administrative access -- dba - Database administration -- security - Security administration -- monitor - Read-only monitoring access </code></pre></div> <h4 id="role-attributes" class="position-relative d-flex align-items-center group"> Role Attributes <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="role-attributes" aria-haspopup="dialog" aria-label="Share link: Role Attributes"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Create role with all attributes CREATE ROLE senior_analyst DESCRIPTION 'Senior data analyst with elevated access' LOGIN FALSE -- Cannot be used for direct login INHERIT TRUE -- Inherits permissions from parent roles VALID UNTIL '2027-01-01' -- Time-limited role MAX_CONNECTIONS 10 -- Limit concurrent connections CONNECTION_LIMIT_PER_USER 3; -- Per-user connection limit </code></pre></div> <h3 id="granting-permissions-to-roles" class="position-relative d-flex align-items-center group"> Granting Permissions to Roles <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="granting-permissions-to-roles" aria-haspopup="dialog" aria-label="Share link: Granting Permissions to Roles"> Share link </button> </h3> <h4 id="data-access-permissions" class="position-relative d-flex align-items-center group"> Data Access Permissions <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="data-access-permissions" aria-haspopup="dialog" aria-label="Share link: Data Access Permissions"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Grant read access GRANT SELECT ON GRAPH analytics TO data_analyst; -- Grant write access GRANT INSERT, UPDATE ON :Event TO data_engineer; -- Grant full data access GRANT SELECT, INSERT, UPDATE, DELETE ON GRAPH operations TO operations_team; -- Grant access to specific labels GRANT SELECT ON :Customer, :Order, :Product TO sales_team; </code></pre></div> <h4 id="schema-permissions" class="position-relative d-flex align-items-center group"> Schema Permissions <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="schema-permissions" aria-haspopup="dialog" aria-label="Share link: Schema Permissions"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Grant schema modification GRANT CREATE CONSTRAINT ON GRAPH analytics TO schema_admin; GRANT CREATE INDEX ON GRAPH analytics TO data_engineer; -- Grant full schema control GRANT CREATE, ALTER, DROP ON GRAPH development TO developer; </code></pre></div> <h4 id="administrative-permissions" class="position-relative d-flex align-items-center group"> Administrative Permissions <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="administrative-permissions" aria-haspopup="dialog" aria-label="Share link: Administrative Permissions"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Grant user management GRANT CREATE USER, ALTER USER, DROP USER TO user_admin; -- Grant role management GRANT CREATE ROLE, ALTER ROLE, DROP ROLE TO security_admin; -- Grant backup capabilities GRANT BACKUP, RESTORE TO backup_operator; </code></pre></div> <h3 id="assigning-roles-to-users" class="position-relative d-flex align-items-center group"> Assigning Roles to Users <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="assigning-roles-to-users" aria-haspopup="dialog" aria-label="Share link: Assigning Roles to Users"> Share link </button> </h3> <h4 id="basic-assignment" class="position-relative d-flex align-items-center group"> Basic Assignment <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="basic-assignment" aria-haspopup="dialog" aria-label="Share link: Basic Assignment"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Assign single role GRANT ROLE data_analyst TO alice; -- Assign multiple roles GRANT ROLE data_analyst, report_viewer TO bob; -- Assign role during user creation CREATE USER charlie PASSWORD 'secure_pass_123' ROLE data_analyst; </code></pre></div> <h4 id="role-assignment-with-options" class="position-relative d-flex align-items-center group"> Role Assignment with Options <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="role-assignment-with-options" aria-haspopup="dialog" aria-label="Share link: Role Assignment with Options"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Allow user to grant this role to others GRANT ROLE data_analyst TO alice WITH ADMIN OPTION; -- Time-limited role assignment GRANT ROLE elevated_access TO consultant VALID UNTIL '2026-03-31'; -- Conditional role assignment GRANT ROLE regional_admin TO manager WHERE manager.region = 'EMEA'; </code></pre></div> <h4 id="viewing-role-assignments" class="position-relative d-flex align-items-center group"> Viewing Role Assignments <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="viewing-role-assignments" aria-haspopup="dialog" aria-label="Share link: Viewing Role Assignments"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Show roles for a user SHOW ROLES FOR alice; -- Show all members of a role SHOW MEMBERS OF ROLE data_analyst; -- Show role membership details SELECT * FROM system.role_members WHERE role_name = 'data_analyst'; </code></pre></div> <h3 id="role-hierarchies" class="position-relative d-flex align-items-center group"> Role Hierarchies <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="role-hierarchies" aria-haspopup="dialog" aria-label="Share link: Role Hierarchies"> Share link </button> </h3>Role hierarchies allow roles to inherit permissions from parent roles, creating a structured permission model. <h4 id="creating-role-hierarchies" class="position-relative d-flex align-items-center group"> Creating Role Hierarchies <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="creating-role-hierarchies" aria-haspopup="dialog" aria-label="Share link: Creating Role Hierarchies"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Create base roles CREATE ROLE viewer; CREATE ROLE editor; CREATE ROLE manager; CREATE ROLE admin; -- Build hierarchy with inheritance ALTER ROLE editor INHERIT viewer; ALTER ROLE manager INHERIT editor; ALTER ROLE admin INHERIT manager; -- Now: admin inherits from manager, which inherits from editor, which inherits from viewer </code></pre></div> <h4 id="hierarchy-with-multiple-parents" class="position-relative d-flex align-items-center group"> Hierarchy with Multiple Parents <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="hierarchy-with-multiple-parents" aria-haspopup="dialog" aria-label="Share link: Hierarchy with Multiple Parents"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Create specialized roles CREATE ROLE analyst INHERITS viewer; CREATE ROLE data_writer INHERITS viewer; -- Create combined role with multiple parents CREATE ROLE data_analyst; ALTER ROLE data_analyst INHERIT analyst, data_writer; -- data_analyst has permissions from both analyst and data_writer </code></pre></div> <h4 id="viewing-role-hierarchy" class="position-relative d-flex align-items-center group"> Viewing Role Hierarchy <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="viewing-role-hierarchy" aria-haspopup="dialog" aria-label="Share link: Viewing Role Hierarchy"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Show complete role hierarchy SHOW ROLE HIERARCHY; -- Output: -- admin -- ├── manager -- │ ├── editor -- │ │ └── viewer -- └── security_admin -- data_analyst -- ├── analyst -- │ └── viewer -- └── data_writer -- └── viewer -- Show hierarchy for specific role SHOW ROLE HIERARCHY FOR manager; -- Show effective permissions including inherited SHOW EFFECTIVE GRANTS FOR ROLE manager; </code></pre></div> <h3 id="role-groups" class="position-relative d-flex align-items-center group"> Role Groups <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="role-groups" aria-haspopup="dialog" aria-label="Share link: Role Groups"> Share link </button> </h3>Organize related roles into groups for easier management: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Create role group CREATE ROLE GROUP analytics_roles DESCRIPTION 'All analytics-related roles'; -- Add roles to group ALTER ROLE GROUP analytics_roles ADD data_analyst, report_viewer, dashboard_user; -- Grant to entire group GRANT SELECT ON GRAPH metrics TO ROLE GROUP analytics_roles; -- View group membership SHOW MEMBERS OF ROLE GROUP analytics_roles; </code></pre></div> <h3 id="revoking-roles-and-permissions" class="position-relative d-flex align-items-center group"> Revoking Roles and Permissions <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="revoking-roles-and-permissions" aria-haspopup="dialog" aria-label="Share link: Revoking Roles and Permissions"> Share link </button> </h3> <h4 id="revoke-role-from-user" class="position-relative d-flex align-items-center group"> Revoke Role from User <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="revoke-role-from-user" aria-haspopup="dialog" aria-label="Share link: Revoke Role from User"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Remove role assignment REVOKE ROLE data_analyst FROM alice; -- Remove multiple roles REVOKE ROLE editor, viewer FROM bob; -- Revoke admin option only REVOKE ADMIN OPTION FOR ROLE data_analyst FROM alice; </code></pre></div> <h4 id="revoke-permissions-from-role" class="position-relative d-flex align-items-center group"> Revoke Permissions from Role <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="revoke-permissions-from-role" aria-haspopup="dialog" aria-label="Share link: Revoke Permissions from Role"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Remove specific permission REVOKE INSERT ON :Customer FROM sales_team; -- Remove multiple permissions REVOKE UPDATE, DELETE ON GRAPH archive FROM analyst; -- Remove all permissions REVOKE ALL ON GRAPH development FROM developer; </code></pre></div> <h4 id="cascading-revocation" class="position-relative d-flex align-items-center group"> Cascading Revocation <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="cascading-revocation" aria-haspopup="dialog" aria-label="Share link: Cascading Revocation"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Revoke and cascade to users who were granted via admin option REVOKE ROLE elevated_access FROM manager CASCADE; -- Revoke permission and remove from all roles that have it REVOKE SELECT ON :ConfidentialData FROM analyst CASCADE TO ROLES; </code></pre></div> <h3 id="dropping-roles" class="position-relative d-flex align-items-center group"> Dropping Roles <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="dropping-roles" aria-haspopup="dialog" aria-label="Share link: Dropping Roles"> Share link </button> </h3><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Drop a role (must have no members) DROP ROLE temp_contractor; -- Drop role and revoke from all members DROP ROLE obsolete_role CASCADE; -- Drop role only if it exists DROP ROLE IF EXISTS legacy_role; </code></pre></div> <h3 id="rbac-configuration-examples" class="position-relative d-flex align-items-center group"> RBAC Configuration Examples <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="rbac-configuration-examples" aria-haspopup="dialog" aria-label="Share link: RBAC Configuration Examples"> Share link </button> </h3> <h4 id="organization-structure-model" class="position-relative d-flex align-items-center group"> Organization Structure Model <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="organization-structure-model" aria-haspopup="dialog" aria-label="Share link: Organization Structure Model"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Executive level CREATE ROLE executive; GRANT SELECT ON GRAPH * TO executive; -- Department heads CREATE ROLE department_head INHERITS executive; GRANT SELECT, INSERT, UPDATE ON GRAPH department_data TO department_head; -- Team leads CREATE ROLE team_lead; GRANT SELECT ON GRAPH team_data TO team_lead; GRANT UPDATE ON :Task TO team_lead; -- Individual contributors CREATE ROLE employee; GRANT SELECT ON :PublicInfo TO employee; -- Department-specific roles CREATE ROLE engineering INHERITS employee; CREATE ROLE sales INHERITS employee; CREATE ROLE hr INHERITS employee; -- Grant department access GRANT SELECT ON :Code, :Project, :Deployment TO engineering; GRANT SELECT, UPDATE ON :Customer, :Lead, :Opportunity TO sales; GRANT ALL ON :Employee, :Compensation TO hr; </code></pre></div> <h4 id="application-service-roles" class="position-relative d-flex align-items-center group"> Application Service Roles <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="application-service-roles" aria-haspopup="dialog" aria-label="Share link: Application Service Roles"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Read-only API service CREATE ROLE api_reader; GRANT SELECT ON GRAPH production TO api_reader; -- Write API service CREATE ROLE api_writer INHERITS api_reader; GRANT INSERT, UPDATE ON :UserEvent, :Transaction TO api_writer; -- Background worker CREATE ROLE background_worker; GRANT SELECT, UPDATE, DELETE ON :Job, :Task TO background_worker; -- Analytics service CREATE ROLE analytics_service; GRANT SELECT ON GRAPH production TO analytics_service; GRANT ALL ON GRAPH analytics TO analytics_service; </code></pre></div> <h4 id="multi-tenant-rbac" class="position-relative d-flex align-items-center group"> Multi-Tenant RBAC <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="multi-tenant-rbac" aria-haspopup="dialog" aria-label="Share link: Multi-Tenant RBAC"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Base tenant role CREATE ROLE tenant_base; -- Tenant-specific roles (dynamically created per tenant) CREATE ROLE tenant_acme_admin INHERITS tenant_base; CREATE ROLE tenant_acme_user INHERITS tenant_base; CREATE ROLE tenant_acme_viewer INHERITS tenant_base; -- Apply tenant isolation via RLS CREATE POLICY tenant_isolation ON :* FOR ALL USING (tenant_id = current_user_property('tenant_id')); -- Grant based on tenant role GRANT ALL ON GRAPH tenant_data TO tenant_acme_admin WHERE current_user_property('tenant_id') = 'acme'; </code></pre></div> <h3 id="role-based-workflows" class="position-relative d-flex align-items-center group"> Role-Based Workflows <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="role-based-workflows" aria-haspopup="dialog" aria-label="Share link: Role-Based Workflows"> Share link </button> </h3> <h4 id="new-employee-onboarding" class="position-relative d-flex align-items-center group"> New Employee Onboarding <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="new-employee-onboarding" aria-haspopup="dialog" aria-label="Share link: New Employee Onboarding"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Create new employee account CREATE USER new_employee@company.com PASSWORD 'initial_password' REQUIRE PASSWORD_CHANGE; -- Assign base role GRANT ROLE employee TO new_employee@company.com; -- Assign department role GRANT ROLE engineering TO new_employee@company.com; -- Assign project-specific roles GRANT ROLE project_alpha_team TO new_employee@company.com; </code></pre></div> <h4 id="employee-role-change" class="position-relative d-flex align-items-center group"> Employee Role Change <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="employee-role-change" aria-haspopup="dialog" aria-label="Share link: Employee Role Change"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Employee promoted to team lead REVOKE ROLE employee FROM alice@company.com; GRANT ROLE team_lead TO alice@company.com; -- Employee changes department REVOKE ROLE engineering FROM bob@company.com; GRANT ROLE sales TO bob@company.com; </code></pre></div> <h4 id="employee-offboarding" class="position-relative d-flex align-items-center group"> Employee Offboarding <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="employee-offboarding" aria-haspopup="dialog" aria-label="Share link: Employee Offboarding"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Remove all roles REVOKE ALL ROLES FROM departing_employee@company.com; -- Disable account ALTER USER departing_employee@company.com DISABLE; -- Or delete account DROP USER departing_employee@company.com; </code></pre></div> <h3 id="temporary-role-assignments" class="position-relative d-flex align-items-center group"> Temporary Role Assignments <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="temporary-role-assignments" aria-haspopup="dialog" aria-label="Share link: Temporary Role Assignments"> Share link </button> </h3> <h4 id="time-limited-access" class="position-relative d-flex align-items-center group"> Time-Limited Access <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="time-limited-access" aria-haspopup="dialog" aria-label="Share link: Time-Limited Access"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Grant temporary elevated access GRANT ROLE admin TO consultant VALID FROM '2026-02-01' VALID UNTIL '2026-02-28'; -- Extend temporary access ALTER ROLE GRANT admin TO consultant VALID UNTIL '2026-03-15'; -- View expiring role assignments SELECT member, role_name, valid_until FROM system.role_members WHERE valid_until < current_timestamp() + INTERVAL '7 days' ORDER BY valid_until; </code></pre></div> <h4 id="emergency-access-procedures" class="position-relative d-flex align-items-center group"> Emergency Access Procedures <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="emergency-access-procedures" aria-haspopup="dialog" aria-label="Share link: Emergency Access Procedures"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Create emergency access role (normally unassigned) CREATE ROLE emergency_admin; GRANT ADMIN ON DATABASE TO emergency_admin; -- Emergency procedure: grant temporary access GRANT ROLE emergency_admin TO on_call_engineer VALID UNTIL current_timestamp() + INTERVAL '4 hours' REASON 'Production incident INC-12345'; -- Automatic audit logging captures all emergency access </code></pre></div> <h3 id="auditing-rbac" class="position-relative d-flex align-items-center group"> Auditing RBAC <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="auditing-rbac" aria-haspopup="dialog" aria-label="Share link: Auditing RBAC"> Share link </button> </h3> <h4 id="permission-audit-queries" class="position-relative d-flex align-items-center group"> Permission Audit Queries <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="permission-audit-queries" aria-haspopup="dialog" aria-label="Share link: Permission Audit Queries"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Find all users with admin access SELECT rm.member, r.role_name FROM system.role_members rm JOIN system.roles r ON rm.role_name = r.role_name WHERE r.role_name = 'admin' OR r.role_name IN (SELECT child_role FROM system.role_hierarchy WHERE parent_role = 'admin'); -- Find unused roles (no members) SELECT r.role_name FROM system.roles r LEFT JOIN system.role_members rm ON r.role_name = rm.role_name WHERE rm.member IS NULL AND r.role_name NOT IN ('public'); -- Find over-privileged users (multiple high-privilege roles) SELECT member, COUNT(*) as admin_role_count FROM system.role_members WHERE role_name IN ('admin', 'dba', 'security_admin') GROUP BY member HAVING COUNT(*) > 1; </code></pre></div> <h4 id="role-usage-audit" class="position-relative d-flex align-items-center group"> Role Usage Audit <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="role-usage-audit" aria-haspopup="dialog" aria-label="Share link: Role Usage Audit"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Track which roles are actively used SELECT rm.role_name, COUNT(DISTINCT rm.member) as member_count, MAX(al.last_activity) as last_used FROM system.role_members rm LEFT JOIN system.activity_log al ON rm.member = al.username GROUP BY rm.role_name ORDER BY last_used DESC; -- Identify permissions never used SELECT p.role_name, p.privilege, p.object_name FROM system.privileges p LEFT JOIN system.access_log al ON p.object_name = al.object_name AND al.username IN (SELECT member FROM system.role_members WHERE role_name = p.role_name) WHERE al.last_access IS NULL OR al.last_access < current_timestamp() - INTERVAL '90 days'; </code></pre></div> <h3 id="rbac-best-practices" class="position-relative d-flex align-items-center group"> RBAC Best Practices <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="rbac-best-practices" aria-haspopup="dialog" aria-label="Share link: RBAC Best Practices"> Share link </button> </h3> <h4 id="1-design-role-hierarchy-first" class="position-relative d-flex align-items-center group"> 1. Design Role Hierarchy First <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="1-design-role-hierarchy-first" aria-haspopup="dialog" aria-label="Share link: 1. Design Role Hierarchy First"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Plan your hierarchy before implementation -- Level 1: Base organizational roles -- Level 2: Department/function roles -- Level 3: Application-specific roles -- Level 4: Temporary/emergency roles CREATE ROLE base_user; -- Level 1 CREATE ROLE department INHERITS base_user; -- Level 2 CREATE ROLE app_role INHERITS department; -- Level 3 CREATE ROLE emergency_access; -- Level 4 (no inheritance) </code></pre></div> <h4 id="2-follow-principle-of-least-privilege" class="position-relative d-flex align-items-center group"> 2. Follow Principle of Least Privilege <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="2-follow-principle-of-least-privilege" aria-haspopup="dialog" aria-label="Share link: 2. Follow Principle of Least Privilege"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Start minimal CREATE ROLE new_role; -- Add permissions incrementally as needed GRANT SELECT ON :PublicData TO new_role; -- Review and justify each addition -- Document why permissions are needed </code></pre></div> <h4 id="3-use-descriptive-role-names" class="position-relative d-flex align-items-center group"> 3. Use Descriptive Role Names <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="3-use-descriptive-role-names" aria-haspopup="dialog" aria-label="Share link: 3. Use Descriptive Role Names"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Good: Clear, descriptive names CREATE ROLE sales_readonly; CREATE ROLE hr_employee_admin; CREATE ROLE api_order_writer; -- Avoid: Vague or personal names -- CREATE ROLE role1; -- CREATE ROLE johns_role; </code></pre></div> <h4 id="4-regular-access-reviews" class="position-relative d-flex align-items-center group"> 4. Regular Access Reviews <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="4-regular-access-reviews" aria-haspopup="dialog" aria-label="Share link: 4. Regular Access Reviews"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Schedule quarterly access reviews # Generate role report geode admin roles report --format=csv --output=role_report.csv # Review for: # - Unused roles # - Over-privileged users # - Expired temporary access # - Orphaned permissions </code></pre></div> <h4 id="5-separate-duties" class="position-relative d-flex align-items-center group"> 5. Separate Duties <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="5-separate-duties" aria-haspopup="dialog" aria-label="Share link: 5. Separate Duties"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Security admin cannot modify data CREATE ROLE security_admin; GRANT CREATE USER, ALTER USER, CREATE ROLE, ALTER ROLE TO security_admin; DENY SELECT, INSERT, UPDATE, DELETE ON GRAPH * TO security_admin; -- DBA cannot manage security CREATE ROLE dba; GRANT BACKUP, RESTORE, CREATE GRAPH, DROP GRAPH TO dba; DENY CREATE USER, ALTER USER, CREATE ROLE, ALTER ROLE TO dba; </code></pre></div> <h3 id="troubleshooting-rbac" class="position-relative d-flex align-items-center group"> Troubleshooting RBAC <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="troubleshooting-rbac" aria-haspopup="dialog" aria-label="Share link: Troubleshooting RBAC"> Share link </button> </h3> <h4 id="permission-denied-issues" class="position-relative d-flex align-items-center group"> Permission Denied Issues <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="permission-denied-issues" aria-haspopup="dialog" aria-label="Share link: Permission Denied Issues"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Check user's roles SHOW ROLES FOR alice; -- Check effective permissions SHOW EFFECTIVE GRANTS FOR alice; -- Check for deny rules SELECT * FROM system.privileges WHERE grantee IN (SELECT role_name FROM system.role_members WHERE member = 'alice') AND is_deny = true; -- Check role hierarchy SHOW ROLE HIERARCHY FOR alice; </code></pre></div> <h4 id="role-assignment-issues" class="position-relative d-flex align-items-center group"> Role Assignment Issues <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="role-assignment-issues" aria-haspopup="dialog" aria-label="Share link: Role Assignment Issues"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Verify role exists SHOW ROLES LIKE 'analyst%'; -- Check if role is assignable SELECT role_name, is_assignable, valid_until FROM system.roles WHERE role_name = 'analyst'; -- Check admin option SELECT member, role_name, with_admin_option FROM system.role_members WHERE member = 'alice'; </code></pre></div> <h3 id="server-configuration" class="position-relative d-flex align-items-center group"> Server Configuration <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="server-configuration" aria-haspopup="dialog" aria-label="Share link: Server Configuration"> Share link </button> </h3><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-yaml" data-lang="yaml"># geode.yaml rbac: enabled: true default_role: public # Role caching cache: enabled: true size: 5000 ttl_seconds: 300 # Audit settings audit: log_role_changes: true log_permission_checks: false # Can be verbose # Security settings security: max_roles_per_user: 50 max_role_depth: 10 prevent_self_grant: true </code></pre></div> <h3 id="related-topics" class="position-relative d-flex align-items-center group"> Related Topics <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="related-topics" aria-haspopup="dialog" aria-label="Share link: Related Topics"> Share link </button> </h3><ul> <li><a href="/tags/authorization/" >Authorization</a> - Comprehensive access control</li> <li><a href="/tags/rls/" >Row-Level Security</a> - Fine-grained data access policies</li> <li><a href="/tags/authentication/" >Authentication</a> - User identity verification</li> <li><a href="/tags/audit-logging/" >Audit Logging</a> - Tracking access and changes</li> <li><a href="/tags/compliance/" >Compliance</a> - Regulatory requirements</li> <li><a href="/tags/security/" >Security</a> - Security overview</li> </ul> <h3 id="further-reading" class="position-relative d-flex align-items-center group"> Further Reading <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="further-reading" aria-haspopup="dialog" aria-label="Share link: Further Reading"> Share link </button> </h3><ul> <li><a href="/docs/architecture/security-architecture/" >Security Architecture</a> - Security design details</li> <li><a href="/docs/security/authorization/" >Authorization Guide</a> - Authorization best practices</li> <li><a href="/docs/reference/" >User Management</a> - User administration reference</li> <li>RBAC Implementation Whitepaper - Detailed RBAC patterns</li> </ul>

Popular

Related Articles

Authorization