Roles

Roles are the fundamental unit of permission management in the Lakehouse, packaging a set of privileges under a name and granting them to users. Role-Based Access Control (RBAC) enables centralized permission management and batch authorization.

RBAC Model

Privilege
  └── Role           ← Privileges packaged as roles
        └── User      ← Roles granted to users

A user can have multiple roles, and the effective permissions are the union of all assigned role permissions.

System Preset Roles

Custom Roles

-- Create a custom role
CREATE ROLE analyst;

-- Grant privileges
GRANT SELECT ON TABLE orders TO ROLE analyst;
GRANT USAGE ON SCHEMA ods TO ROLE analyst;

-- Grant a role to a user
GRANT ROLE analyst TO USER alice;

-- View role privileges
SHOW GRANTS TO ROLE analyst;

Related Documentation

• Role Management Details
• User Management
• Dynamic Masking — Role-based masking control
• Row-Level Permission — Role-based row-level access control