Skip to main content
Catalog privileges manage access at the catalog, database, table, and column level. They ensure only intended users can query data, and they are deny-by-default - when a catalog is created, all access is denied until you create a privilege that grants it.
Managing catalog privileges requires an administrative role; querying data requires a role with query access. See Roles and permissions. Use access control carefully, as it governs who can read potentially sensitive data.

​
How privileges resolve

  • The permission hierarchy is Catalog → Database → Table → Column. Selecting a database includes all its tables unless you select specific tables; selecting a table includes all its columns unless you select specific columns.
  • Selecting all (*), or leaving the table/column fields empty, grants access to everything below the selected level.
  • With no privilege defined for a catalog, access is denied by default.
  • A user or group can belong to multiple privileges at once. Allow grants query access; Deny always takes precedence over Allow.
  • Allow up to 60 seconds for a new or changed privilege to be applied by the SQL engine.
  • A newly added user has no query access until they’re assigned to a catalog privilege.

​
Create a privilege

  1. Navigate to Catalogs and click the desired catalog.
  2. Select the Privilege tab.
  3. Click Create Privileges and give the privilege a name (and optional description).
  4. Select the Access Control privilege type.
  5. Select the databases, tables, and columns.
  6. Choose the access type - Allow or Deny.
  7. Select the user(s) and group(s) the privilege applies to.
  8. Click Create. The privilege appears in the Privileges list.
To edit, click the three dots next to a privilege, select Edit, adjust the resources, access type, or assigned users/groups, and click Update.

​
Allow privileges

An Allow privilege grants access to the selected resources. Multiple Allow privileges are additive - if any grants access (and no Deny applies), the query runs. Common patterns:
  • All databases: select all databases; leave table/column fields empty to grant access to the entire catalog.
  • Selected databases: select specific databases (and optionally tables/columns) - access to unselected databases is denied.
  • Selected tables and columns: select a schema and table, then specific columns - querying unselected columns fails, while querying the permitted columns succeeds.
Verify a privilege from the Query Editor: select the catalog, database, and cluster, and run queries to confirm only authorized data returns.

​
Deny privileges

A Deny privilege restricts access to the selected resources and takes precedence over any Allow. A Deny only denies - it does not grant access to anything else.
A Deny privilege results solely in access denial; it does not imply permission for other resources. To grant access, create a separate Allow privilege.
Deny works at the same granularity as Allow - all databases, selected databases, or selected tables and columns. For example, a Deny on all databases blocks query execution across the catalog regardless of Allow privileges.

​
See also

Last modified on September 29, 2026