Roles and Privileges

HEAVY.AI supports data security using a set of database object access privileges granted to users or roles.
Users and Privileges
When you create a database, the admin superuser is created by default. The admin superuser is granted all privileges on all database objects. Superusers can create new users that, by default, have no database object privileges.
Superusers can grant users selective access privileges on multiple database objects using two mechanisms: role-based privileges and user-based privileges.
Role-based Privileges
1.Grant roles access privileges on database objects.
2.Grant roles to users.
3.Grant roles to other roles.
User-based Privileges
When a user has privilege requirements that differ from role privileges, you can grant privileges directly to the user. These mechanisms provide data security for many users and classes of users to access the database.
You have the following options for granting privileges:
Each object privilege can be granted to one or many roles, or to one or many users.
A role and/or user can be granted privileges on one or many objects.
A role can be granted to one or many users or other roles.
A user can be granted one or many roles.
This supports the following many-to-many relationships:
Objects and roles
Objects and users
Roles and users
These relationships provide flexibility and convenience when granting/revoking privileges to and from users.
Granting object privileges to roles and users, and granting roles to users, has a cumulative effect. The result of several grant commands is a combination of all individual grant commands. This applies to all database object types and to privileges inherited by objects. For example, object privileges granted to the object of database type are propagated to all table-type objects of that database object.
Who Can Grant Object Privileges?
Only a superuser or an object owner can grant privileges for on object.
A superuser has all privileges on all database objects.
A non-superuser user has only those privileges on a database object that are granted by a superuser.
A non-superuser user has ALL privileges on a table created by that user.
Roles and Privileges Persistence
Roles can be created and dropped at any time.
Object privileges and roles can be granted or revoked at any time, and the action takes effect immediately.
Privilege state is persistent and restored if the HEAVY.AI session is interrupted.
Database Object Privileges
There are five database object types, each with its own privileges.
Database
Table
View
Dashboard
Server
ACCESS - Connect to the database. The ACCESS privilege is a prerequisite for all other privileges at the database level. Without the ACCESS privilege, a user or role cannot perform tasks on any other database objects.
ALL - Allow all privileges on this database except issuing grants and dropping the database.
SELECT, INSERT, TRUNCATE, UPDATE, DELETE - Allow these operations on any table in the database.
ALTER SERVER - Alter servers in the current database.
CREATE SERVER - Create servers in the current database.
CREATE TABLE - Create a table in the current database. (Also CREATE.)
CREATE VIEW - Create a view for the current database.
CREATE DASHBOARD - Create a dashboard for the current database.
DELETE DASHBOARD - Delete a dashboard for this database.
DROP SERVER - Drop servers from the current database.
DROP - Drop a table from the database.
DROP VIEW - Drop a view for this database.
EDIT DASHBOARD - Edit a dashboard for this database.
SELECT VIEW - Select a view for this database.
SERVER USAGE - Use servers (through foreign tables) in the current database.
VIEW DASHBOARD - View a dashboard for this database.
VIEW SQL EDITOR - Access the SQL Editor in Immerse for this database.
SELECT, INSERT, TRUNCATE, UPDATE, DELETE - Allow these SQL statements on this table.
DROP - Drop this table.
SELECT - Select from this view. Users do not need privileges on objects referenced by this view.
DROP - Drop this view.
VIEW - View this dashboard.
EDIT - Edit this dashboard.
DELETE - Delete this dashboard.
DROP - Drop this server from the current database.
ALTER - Alter this server in the current database.
USAGE - Use this server (through foreign tables) in the current database.
Privileges granted on a database-type object are inherited by all tables of that database.
Privilege Commands
SQL
Description
​CREATE ROLE​
Create role.
​DROP ROLE​
Drop role.
​GRANT​
Grant role to user or to another role.
​REVOKE​
Revoke role from user or from another role.
​GRANT ON TABLE​
Grant role privilege(s) on a database table to a role or user.
​REVOKE ON TABLE​
Revoke role privilege(s) on database table from a role or user.
​GRANT ON VIEW​
Grant role privilege(s) on a database view to a role or user.
​REVOKE ON VIEW​
Revoke role privilege(s) on database view from a role or user.
​GRANT ON DATABASE​
Grant role privilege(s) on database to a role or user.
​REVOKE ON DATABASE​
Revoke role privilege(s) on database from a role or user.
​GRANT ON SERVER​
Grant role privilege(s) on server to a role or user.
​REVOKE ON SERVER​
Revoke role privilege(s) on server from a role or user.
​GRANT ON DASHBOARD​
Grant role privilege(s) on dashboard to a role or user.
​REVOKE ON DASHBOARD​
Revoke role privilege(s) on dashboard from a role or user.
Example
The following example shows a valid sequence for granting access privileges to non-superuser user1 by granting a role to user1 and by directly granting a privilege. This example presumes that table1 and user1 already exist, and that user1 has ACCESS privileges on the database where table1 exists.
1.Create the r_select role.
2.Grant the SELECT privilege on table1 to the r_select role. Any user granted the r_select role gains the SELECT privilege.
1
GRANT SELECT ON TABLE table1 TO r_select;
Copied!
3.Grant the r_select role to user1, giving user1 the SELECT privilege on table1.
4.Directly grant user1 the INSERT privilege on table1.
1
GRANT INSERT ON TABLE table1 TO user1;
Copied!
See Example Roles and Privileges Session for a more complete example.
CREATE ROLE
Create a role. Roles are granted to users for role-based database object access.
This clause requires superuser privilege and <roleName> must not exist.
Synopsis
1
CREATE ROLE <roleName>;
Copied!
Parameters
<roleName>
Name of the role to create.
Example
Create a payroll department role called payrollDept.
1
CREATE ROLE payrollDept;
Copied!
See Also
​Users and Databases​
​DROP ROLE​
DROP ROLE
Remove a role.
This clause requires superuser privilege and <roleName> must exist.
Synopsis
1
DROP ROLE [IF EXISTS] <roleName>;
Copied!
Parameters
<roleName>
Name of the role to drop.
Example
Remove the payrollDept role.
1
DROP ROLE payrollDept;
Copied!
See Also
​Users and Databases​
​CREATE ROLE​
GRANT
Grant role privileges to users and to other roles.
The ACCESS privilege is a prerequisite for all other privileges at the database level. Without the ACCESS privilege, a user or role cannot perform tasks on any other database objects.
This clause requires superuser privilege. The specified <roleNames> and <userNames> must exist.
Synopsis
1
GRANT <roleNames> TO <userNames>, <roleNames>;
Copied!
Parameters
<roleNames>
Names of roles to grant to users and other roles. Use commas to separate multiple role names.
<userNames>
Names of users. Use commas to separate multiple user names.
Examples
Assign payrollDept role privileges to user dennis.
1
GRANT payrollDept TO dennis;
Copied!
Grant payrollDept and accountsPayableDept role privileges to users dennis and mike and role hrDept.
1
GRANT payrollDept, accountsPayableDept TO dennis, mike, hrDept;
Copied!
See Also
​Users and Databases​
​CREATE ROLE​
​GRANT ON TABLE​
​GRANT ON DATABASE​
REVOKE
Remove role privilege from users or from other roles. This removes database object access privileges granted with the role.
This clause requires superuser privilege. The specified <roleNames> and <userNames> must exist.
Synopsis
1
REVOKE <roleNames> FROM <userNames>, <roleNames>;
Copied!
Parameters
<roleNames>
Names of roles to remove from users and other roles. Use commas to separate multiple role names.
<userName>
Names of the users. Use commas to separate multiple user names.
Example
Remove payrollDept role privileges from user dennis.
1
REVOKE payrollDept FROM dennis;
Copied!
Revoke payrollDept and accountsPayableDept role privileges from users dennis and fred and role hrDept.
1
REVOKE payrollDept, accountsPayableDept FROM dennis, fred, hrDept;
Copied!
See Also
​Users and Databases​
​CREATE ROLE​
​GRANT​
GRANT ON TABLE
Define the privilege(s) a role or user has on the specified table. You can specify any combination of the INSERT, SELECT, DELETE, UPDATE, DROP, or TRUNCATE privilege or specify all privileges.
The ACCESS privilege is a prerequisite for all other privileges at the database level. Without the ACCESS privilege, a user or role cannot perform tasks on any other database objects.
This clause requires superuser privilege, or <tableName> must have been created by the user invoking this command. The specified <tableName> and users or roles defined in <entityList> must exist.
Synopsis
1
GRANT <privilegeList> ON TABLE <tableName> TO <entityList>;
Copied!
Parameters
<privilegeList>
Parameter Value
Descriptions
ALL
Grant all possible access privileges on <tableName> to <entityList>.
ALTER TABLE
Grant ALTER TABLE privilege on <tableName> to <entityList>.
DELETE
Grant DELETE privilege on <tableName> to <entityList>.
DROP
Grant DROP privilege on <tableName> to <entityList>.
INSERT
Grant INSERT privilege on <tableName> to <entityList>.
SELECT
Grant SELECT privilege on <tableName> to <entityList>.
TRUNCATE
Grant TRUNCATE privilege on <tableName> to <entityList>.
UPDATE
Grant UPDATE privilege on <tableName> to <entityList>.
<tableName>
Name of the database table.
<entityList>
Name of entity or entities to be granted the privilege(s).
Parameter Value
Descriptions
role
Name of role.
user
Name of user.
Examples
Permit all privileges on the employees table for the payrollDept role.
1
GRANT ALL ON TABLE employees TO payrollDept;
Copied!
Permit SELECT-only privilege on the employees table for user chris.
1
GRANT SELECT ON TABLE employees TO chris;
Copied!
Permit INSERT-only privilege on the employees table for the hrdept and accountsPayableDept roles.
1
GRANT INSERT ON TABLE employees TO hrDept, accountsPayableDept;
Copied!
Permit INSERT, SELECT, and TRUNCATE privileges on the employees table for the role hrDept and for users dennis and mike.
1
GRANT INSERT, SELECT, TRUNCATE ON TABLE employees TO hrDept, dennis, mike;
Copied!
See Also
​REVOKE ON TABLE​
​Tables​
​CREATE ROLE​
​GRANT ON DATABASE​
REVOKE ON TABLE
Remove the privilege(s) a role or user has on the specified table. You can remove any combination of the INSERT, SELECT, DELETE, UPDATE, or TRUNCATE privileges, or remove all privileges.
This clause requires superuser privilege or <tableName> must have been created by the user invoking this command. The specified <tableName> and users or roles in <entityList> must exist.
Synopsis
1
REVOKE <privilegeList> ON TABLE <tableName> FROM <entityList>;
Copied!
Parameters
<privilegeList>
Parameter Value
Descriptions
ALL
Remove all access privilege for <entityList> on <tableName>.
ALTER TABLE
Remove ALTER TABLE privilege for <entityList> on <tableName>.
DELETE
Remove DELETE privilege for <entityList> on <tableName>.
DROP
Remove DROP privilege for <entityList> on <tableName>.
INSERT
Remove INSERT privilege for <entityList> on <tableName>.
SELECT
Remove SELECT privilege for <entityList> on <tableName>.
TRUNCATE
Remove TRUNCATE privilege for <entityList> on <tableName>.
UPDATE
Remove UPDATE privilege for <entityList> on <tableName>.
<tableName>
Name of the database table.
<entityList>
Name of entities to be denied the privilege(s).
Parameter Value
Descriptions
role
Name of role.
user
Name of user.
Example
Prohibit SELECT and INSERT operations on the employees table for the nonemployee role.
1
REVOKE ALL ON TABLE employees FROM nonemployee;
Copied!
Prohibit SELECT operations on the directors table for the employee role.
1
REVOKE SELECT ON TABLE directors FROM employee;
Copied!
Prohibit INSERT operations on the directors table for role employee and user laura.
1
REVOKE INSERT ON TABLE directors FROM employee, laura;
Copied!
Prohibit INSERT, SELECT, and TRUNCATE privileges on the employees table for the role nonemployee and for users dennis and mike.
1
REVOKE INSERT, SELECT, TRUNCATE ON TABLE employees FROM nonemployee, dennis, mike;
Copied!
See Also
​GRANT ON TABLE​
​GRANT ON DATABASE​
GRANT ON VIEW
Define the privileges a role or user has on the specified view. You can specify any combination of the SELECT, INSERT, or DROP privileges, or specify all privileges.
This clause requires superuser privileges, or <viewName> must have been created by the user invoking this command. The specified <viewName> and users or roles in <entityList> must exist.
Synopsis
1
GRANT <privilegeList> ON VIEW <viewName> TO <entityList>;
Copied!
Parameters
<privilegeList>
Parameter Value
Descriptions
ALL
Grant all possible access privileges on <viewName> to <entityList>.
DROP
Grant DROP privilege on <viewName> to <entityList>.
INSERT
Grant INSERT privilege on <viewName> to <entityList>.
SELECT
Grant SELECT privilege on <viewName> to <entityList>.
<viewName>
Name of the database view.
<entityList>
Name of entities to be granted the privileges.
Parameter Value
Descriptions
role
Name of role.
user
Name of user.
Examples
Permit SELECT, INSERT, and DROP privileges on the employees view for the payrollDept role.
1
GRANT ALL ON VIEW employees TO payrollDept;
Copied!
Permit SELECT-only privilege on the employees view for the employee role and user venkat.
1
GRANT SELECT ON VIEW employees TO employee, venkat;
Copied!
Permit INSERT and DROP privileges on the employees view for the hrDept and acctPayableDept roles and users simon and dmitri.
1
GRANT INSERT, DROP ON VIEW employees TO hrDept, acctPayableDept, simon, dmitri;
Copied!
See Also
​REVOKE ON VIEW​
​DDL-VIEWS​
​CREATE ROLE​
​GRANT ON DATABASE​
REVOKE ON VIEW
Remove the privileges a role or user has on the specified view. You can remove any combination of the INSERT, DROP, or SELECT privileges, or remove all privileges.
This clause requires superuser privilege, or <viewName> must have been created by the user invoking this command. The specified <viewName> and users or roles in <entityList> must exist.
Synopsis
1
REVOKE <privilegeList> ON VIEW <viewName> FROM <entityList>;
Copied!
Parameters
<privilegeList>
Parameter Value
Descriptions
ALL
Remove all access privilege for <entityList> on <viewName>.
DROP
Remove DROP privilege for <entityList> on <viewName>.
INSERT
Remove INSERT privilege for <entityList> on <viewName>.
SELECT
Remove SELECT privilege for <entityList> on <viewName>.
<viewName>
Name of the database view.
<entityList>
Name of entity to be denied the privilege(s).
Parameter Value
Descriptions
role
Name of role.
user
Name of user.
Example
Prohibit SELECT, DROP, and INSERT operations on the employees view for the nonemployee role.
1
REVOKE ALL ON VIEW employees FROM nonemployee;
Copied!
Prohibit SELECT operations on the directors view for the employee role.
1
REVOKE SELECT ON VIEW directors FROM employee;
Copied!
Prohibit INSERT and DROP operations on the directors view for the employee and manager role and for users ashish and lindsey.
1
REVOKE INSERT, DROP ON VIEW directors FROM employee, manager, ashish, lindsey;
Copied!
See Also
​GRANT ON VIEW​
​GRANT ON DATABASE​
GRANT ON DATABASE
Define the valid privileges a role or user has on the specified database. You can specify any combination of privileges, or specify all privileges.
The ACCESS privilege is a prerequisite for all other privileges at the database level. Without the ACCESS privilege, a user or role cannot perform tasks on any other database objects.
This clause requires superuser privileges.
Synopsis
1
GRANT <privilegeList> ON DATABASE <dbName> TO <entityList>;
Copied!
Parameters
<privilegeList>
Parameter Value
Descriptions
ACCESS
Grant ACCESS (connection) privilege on <dbName> to <entityList>.
ALL
Grant all possible access privileges on <dbName> to <entityList>.
ALTER TABLE
Grant ALTER TABLE privilege on <dbName> to <entityList>.
ALTER SERVER
Grant ALTER SERVER privilege on <dbName> to <entityList>.
CREATE SERVER
Grant CREATE SERVER privilege on <dbName> to <entityList>;
CREATE TABLE
Grant CREATE TABLE privilege on <dbName> to <entityList>. Previously CREATE.
CREATE VIEW
Grant CREATE VIEW privilege on <dbName> to <entityList>.
CREATE DASHBOARD
Grant CREATE DASHBOARD privilege on <dbName> to <entityList>.
CREATE
Grant CREATE privilege on <dbName> to <entityList>.
DELETE
Grant DELETE privilege on <dbName> to <entityList>.
DELETE DASHBOARD
Grant DELETE DASHBOARD privilege on <dbName> to <entityList>.
DROP
Grant DROP privilege on <dbName> to <entityList>.
DROP SERVER
Grant DROP privilege on <dbName> to <entityList>.
DROP VIEW
Grant DROP VIEW privilege on <dbName> to <entityList>.
EDIT DASHBOARD
Grant EDIT DASHBOARD privilege on <dbName> to <entityList>.
INSERT
Grant INSERT privilege on <dbName> to <entityList>.
SELECT
Grant SELECT privilege on <dbName> to <entityList>.
SELECT VIEW
Grant SELECT VIEW privilege on <dbName> to <entityList>.
SERVER USAGE
Grant SERVER USAGE privilege on <dbName> to <entityList>.
<dbName>
Name of the database, which must exist, created by CREATE DATABASE.
<entityList>
Name of the entity to be granted the privilege.
Parameter Value
Descriptions
role
Name of role, which must exist.
user
Name of user, which must exist. See Users and Databases.
Examples
Permit all operations on the companydb database for the payrollDept role and user david.
1
GRANT ALL ON DATABASE companydb TO payrollDept, david;
Copied!
Permit SELECT-only operations on the companydb database for the employee role.
1
GRANT ACCESS, SELECT ON DATABASE companydb TO employee;
Copied!
Permit INSERT, UPDATE, and DROP operations on the companydb database for the hrdept and manager role and for users irene and stephen.
1
GRANT ACCESS, INSERT, UPDATE, DROP ON DATABASE companydb TO hrdept, manager, irene, stephen;
Copied!
See Also
​REVOKE ON DATABASE
​GRANT ON TABLE​
​CREATE ROLE​
REVOKE ON DATABASE
Remove the operations a role or user can perform on the specified database. You can specify privileges individually or specify all privileges.
This clause requires superuser privilege or the user must own the database object. The specified <dbName> and roles or users in <entityList> must exist.
Synopsis
1
REVOKE <privilegeList> ON DATABASE <dbName> FROM <entityList>;
Copied!
Parameters
<privilegeList>
Parameter Value
Descriptions
ACCESS
Remove ACCESS (connection) privilege on <dbName> from <entityList>.
ALL
Remove all possible privileges on <dbName> from <entityList>.
ALTER SERVER
Remove ALTER SERVER privilege on <dbName> from <entityList>
ALTER TABLE
Remove ALTER TABLE privilege on <dbName> from <entityList>.
CREATE TABLE
Remove CREATE TABLE privilege on <dbName> from <entityList>. Previously CREATE.
CREATE VIEW
Remove CREATE VIEW privilege on <dbName> from <entityList>.
CREATE DASHBOARD
Remove CREATE DASHBOARD privilege on <dbName> from <entityList>.
CREATE
Remove CREATE privilege on <dbName> from <entityList>.
CREATE SERVER
Remove CREATE SERVER privilege on <dbName> from <entityList>.
DELETE
Remove DELETE privilege on <dbName> from <entityList>.
DELETE DASHBOARD
Remove DELETE DASHBOARD privilege on <dbName> from <entityList>.
DROP
Remove DROP privilege on <dbName> from <entityList>.
DROP SERVER
Remove DROP SERVER privilege on <dbName> from <entityList>.
DROP VIEW
Remove DROP VIEW privilege on <dbName> from <entityList>.
EDIT DASHBOARD
Remove EDIT DASHBOARD privilege on <dbName> from <entityList>.
INSERT
Remove INSERT privilege on <dbName> from <entityList>.
SELECT
Remove SELECT privilege on <dbName> from <entityList>.
SELECT VIEW
Remove SELECT VIEW privilege on <dbName> from <entityList>.
SERVER USAGE
Remove SERVER USAGE privilege on <dbName> from <entityList>.
<dbName>
Name of the database.
<entityList>
Parameter Value
Descriptions
role
Name of role.
user
Name of user.
Example
Prohibit all operations on the employees database for the nonemployee role.
1
REVOKE ALL ON DATABASE employees FROM nonemployee;
Copied!
Prohibit SELECT operations on the directors database for the employee role and for user monica.
1
REVOKE SELECT ON DATABASE directors FROM employee;
Copied!
Prohibit INSERT, DROP, CREATE, and DELETE operations on the directors database for employee role and for users max and alex.
1
REVOKE INSERT, DROP, CREATE, DELETE ON DATABASE directors FROM employee;
Copied!
See Also
​GRANT ON DATABASE​
​GRANT ON TABLE​
​
GRANT ON SERVER
Define the valid privileges a role or user has for working with servers. You can specify any combination of privileges or specify all privileges.
This clause requires superuser privileges, or <serverName> must have been created by the user invoking the command.
Synopsis
1
GRANT <privilegeList> ON SERVER <serverName> TO <entityList>;
Copied!
Parameters
<privilegeList>
Parameter Value
Descriptions
DROP
Grant DROP privileges on <serverName> on current database to <entityList>.
ALTER
Grant ALTER privilege on <serverName> on current database to <entityList>.
USAGE
Grant USAGE privilege (through foreign tables) on <serverName> on current database to <entityList>.
<serverName>
Name of the server, which must exist on the current database, created by CREATE SERVER ON DATABASE. 
<entityList>
Parameter Value
Descriptions
role
Name of role, which must exist.
user
Name of user, which must exist. See Users and Databases.
Examples
Grant DROP privilege on server parquet_s3_server to user fred:
1
GRANT DROP ON SERVER parquet_s3_server TO fred
Copied!
Grant ALTER privilege on server parquet_s3_server to role payrollDept:
1
GRANT ALTER ON SERVER parquet_s3_server TO payrollDept;
Copied!
Grant USAGE and ALTER privileges on server parquet_s3_server to role payrollDept and user jamie:
1
GRANT USAGE, ALTER ON SERVER parquet_s3_server TO payrollDept, jamie;
Copied!
See Also
​REVOKE ON SERVER​
REVOKE ON SERVER
Remove privileges a role or user has for working with servers. You can specify any combination of privileges or specify all privileges.
This clause requires superuser privileges, or <serverName> must have been created by the user invoking the command.
Synopsis
1
REVOKE <privilegeList> ON SERVER <serverName> FROM <entityList>;
Copied!
Parameters
<privilegeList>
Parameter Value
Descriptions
DROP
Remove DROP privileges on <serverName> on current database for <entityList>.
ALTER
Remove ALTER privilege on <serverName> on current database for <entityList>.
USAGE
Remove USAGE privilege (through foreign tables) on <serverName> on current database for <entityList>.
<serverName>
Name of the server, which must exist on the current database, created by CREATE SERVER ON DATABASE. 
<entityList>
Parameter Value
Descriptions
role
Name of role, which must exist.
user
Name of user, which must exist. See Users and Databases.
Examples
Revoke DROP privilege on server parquet_s3_server for user inga:
1
REVOKE DROP ON SERVER parquet_s3_server FROM inga
Copied!
Grant ALTER privilege on server parquet_s3_server for role payrollDept:
1
REVOKE ALTER ON SERVER parquet_s3_server FROM payrollDept;
Copied!
Grant USAGE and ALTER privileges on server parquet_s3_server for role payrollDept and user marvin:
1
REVOKE USAGE, ALTER ON SERVER parquet_s3_server FROM payrollDept, marvin;
Copied!
See Also
​GRANT ON SERVER​
GRANT ON DASHBOARD
Define the valid privileges a role or user has for working with dashboards. You can specify any combination of privileges or specify all privileges.
This clause requires superuser privileges.
Synopsis
1
GRANT <privilegeList> [ON DASHBOARD <dashboardId>] TO <entityList>;
Copied!
Parameters
<privilegeList>
Parameter Value
Descriptions
ALL
Grant all possible access privileges on <dashboardId> to <entityList>.
CREATE
Grant CREATE privilege to <entityList>.
DELETE
Grant DELETE privilege on <dashboardId> to <entityList>.
EDIT
Grant EDIT privilege on <dashboardId> to <entityList>.
VIEW
Grant VIEW privilege on <dashboardId> to <entityList>.
<dashboardId>
ID of the dashboard, which must exist, created by CREATE DASHBOARD. To show a list of all dashboards and IDs in heavysql, run the \dash command when logged in as superuser.
<entityList>
Parameter Value
Descriptions
role
Name of role, which must exist.
user
Name of user, which must exist. See Users and Databases.
Examples
Permit all privileges on the dashboard ID 740 for the payrollDept role.
1
GRANT ALL ON DASHBOARD 740 TO payrollDept;
Copied!
Permit VIEW-only privilege on dashboard 730 for the hrDept role and user dennis.
1
GRANT VIEW ON DASHBOARD 730 TO hrDept, dennis;
Copied!
Permit EDIT and DELETE privileges on dashboard 740 for the hrDept and accountsPayableDept roles and for user pavan.
1
GRANT EDIT, DELETE ON DASHBOARD 740 TO hrdept, accountsPayableDept, pavan;
Copied!
See Also
​REVOKE ON DASHBOARD​
REVOKE ON DASHBOARD
Remove privileges a role or user has for working with dashboards. You can specify any combination of privileges, or all privileges.
This clause requires superuser privileges.
Synopsis
1
REVOKE <privilegeList> [ON DASHBOARD <dashboardId>] FROM <entityList>;
Copied!
Parameters
<privilegeList>
Parameter Value
Descriptions
ALL
Revoke all possible access privileges on <dashboardId> for <entityList>.
CREATE
Revoke CREATE privilege for <entityList>.
DELETE
Revoke DELETE privilege on <dashboardId> for <entityList>.
EDIT
Revoke EDIT privilege on <dashboardId> for <entityList>.
VIEW
Revoke VIEW privilege on <dashboardId> for <entityList>.
<dashboardId>
ID of the dashboard, which must exist, created by CREATE DASHBOARD.
<entityList>
Parameter Value
Descriptions
role
Name of role, which must exist.
user
Name of user, which must exist. See Users and Databases.
Revoke DELETE privileges on dashboard 740 for the payrollDept role.
1
REVOKE DELETE ON DASHBOARD 740 FROM payrollDept;
Copied!
Revoke all privileges on dashboard 730 for hrDept role and users dennis and mike.
1
REVOKE ALL ON DASHBOARD 730 FROM hrDept, dennis, mike;
Copied!
Revoke EDIT and DELETE of dashboard 740 for the hrDept and accountsPayableDept roles and for users dante and jonathan.
1
REVOKE EDIT, DELETE ON DASHBOARD 740 FROM hrdept, accountsPayableDept, dante, jonathan;
Copied!
See Also
​GRANT ON DASHBOARD​
Common Privilege Levels for Non-Superusers
The following privilege levels are typically recommended for non-superusers in Immerse. Privileges assigned for users in your organization may vary depending on access requirements.
Privilege
Command Syntax to Grant Privilege
Access a database
GRANT ACCESS ON DATABASE <dbName> TO <entityList>;
Create a table
GRANT CREATE TABLE ON DATABASE <dbName> TO <entityList>;
Select a table
GRANT SELECT ON TABLE <tableName> TO <entityList>;
View a dashboard
GRANT VIEW ON DASHBOARD <dashboardId> TO <entityList>;
Create a dashboard
GRANT CREATE DASHBOARD ON DATABASE <dbName> TO <entityList>;
Edit a dashboard
GRANT EDIT ON DASHBOARD  TO ;
Delete a dashboard
GRANT DELETE DASHBOARD ON DATABASE <dbName> TO <entityList>;
Example: Roles and Privileges
These examples assume that tables table1 through table4 are created as needed:
1
create table table1 (id smallint);
2
create table table2 (id smallint);
3
create table table3 (id smallint);
4
create table table4 (id smallint);
Copied!
The following examples show how to work with users, roles, tables, and dashboards.
Create User Accounts
1
create user marketingDeptEmployee1 (password = 'md1');
2
create user marketingDeptEmployee2 (password = 'md2');
3
create user marketingDeptManagerEmployee3 (password = 'md3');
4
​
5
create user salesDeptEmployee1 (password = 'sd1');
6
create user salesDeptEmployee2 (password = 'sd2');
7
create user salesDeptEmployee3 (password = 'sd3');
8
create user salesDeptEmployee4 (password = 'sd4');
9
create user salesDeptManagerEmployee5 (password = 'sd5');
Copied!
Grant Access to Users on Database
1
grant access on database heavyai to marketingDeptEmployee1, marketingDeptEmployee2, marketingDeptManagerEmployee3;
2
grant access on database heavyai to salesDeptEmployee1, salesDeptEmployee2, salesDeptEmployee3, salesDeptEmployee4, salesDeptManagerEmployee5;
Copied!
Create Marketing Department Roles
1
create role marketingDeptRole1;
2
create role marketingDeptRole2;
Copied!
Grant Marketing Department Roles to Marketing Department Employees
1
grant marketingDeptRole1 to marketingDeptEmployee1, marketingDeptManagerEmployee3;
2
grant marketingDeptRole2 to marketingDeptEmployee2, marketingDeptManagerEmployee3;
Copied!
Grant Privelege to Marketing Department Roles
1
grant select on table table1 to marketingDeptRole1;
2
grant select on table table2 to marketingDeptRole1;
3
grant select on table table2 to marketingDeptRole2;
Copied!
Create Sales Department Roles
1
create role salesDeptRole1;
2
create role salesDeptRole2;
3
create role salesDeptRole3;
Copied!
Grant Sales Department Roles to Sales Department Employees
1
grant salesDeptRole1 to salesDeptEmployee1;
2
grant salesDeptRole2 to salesDeptEmployee2, salesDeptEmployee3;
3
grant salesDeptRole3 to salesDeptEmployee4;
Copied!
Grant Privilege to Sales Department Roles
1
grant select on table table1 to salesDeptRole1;
2
grant select on table table3 to salesDeptRole1, salesDeptRole2;
3
grant select on table table4 to salesDeptRole3;
Copied!
Grant All Sales Roles to Sales Department Manager and Marketing Department Manager
1
grant salesDeptRole1, salesDeptRole2, salesDeptRole3 to salesDeptManagerEmployee5, marketingDeptManagerEmployee3;
Copied!
Grant View on Dashboards
Use the \dash command to list all dashboards and their unique IDs in HEAVY.AI: