Privilege Categories

This page provides a quick reference to SQL privilege categories within a MatrixOne instance (tenant). To create users, bind roles, and perform console operations, see Permissions · MatrixOne. For AI Studio workspace roles and platform privilege points, see User Permissions and Permission Reference. They use a different model.

Key concepts

• Privileges are granted to roles, and roles are then granted to users. A user without a role cannot perform operations.

• Objects have an Owner. The Owner can manage privileges on the object through discretionary access control.

• The administrator created with an instance has the broadest management capabilities. Instances cannot access one another’s tenant resources.

Administrator (Account) level

Privilege	Meaning
CREATE USER / DROP USER / ALTER USER	User lifecycle
CREATE ROLE / DROP ROLE	Role lifecycle
CREATE DATABASE / DROP DATABASE	Database lifecycle
SHOW DATABASES	Lists databases in the tenant
CONNECT	Allows connection-side operations that do not depend on a specific object, such as USE, and some object-free SELECT operations
MANAGE GRANTS	Manages grants and role inheritance
ALL [PRIVILEGES] / OWNERSHIP	All tenant-level privileges. OWNERSHIP can be used with WITH GRANT OPTION.

User level

Privilege	Meaning
OWNERSHIP (user object)	Manages the user, including information, password, and deletion, and can grant this privilege onward

Role level

Privilege	Meaning
OWNERSHIP (role object)	Manages the role, including its name, description, and deletion, and can grant this privilege onward

Database level

Privilege	Meaning
SHOW TABLES	Lists tables in the database
CREATE TABLE / DROP TABLE	Table lifecycle
CREATE VIEW / DROP VIEW / ALTER VIEW	Views
ALTER TABLE	Alters tables
ALL / OWNERSHIP	All privileges on the database. OWNERSHIP can be granted onward.

Table level

Privilege	Meaning
SELECT / INSERT / UPDATE / DELETE / TRUNCATE	Reads, writes, and clears data
REFERENCE	Uses the table as a foreign-key target and views its structure with DESCRIBE / SHOW
INDEX	Creates or drops indexes
ALL / OWNERSHIP	All privileges on the table. OWNERSHIP can be granted onward.

Execution

Privilege	Meaning
EXECUTE	Executes a function or stored procedure

Publication and subscription

Data sharing across instances, including multiple instances under the same account. Historically, documentation limits most publication and subscription operations to administrative roles such as moadmin / accountadmin. Refer to the current instance’s role capabilities.

Publisher

Privilege	Meaning
CREATE PUBLICATION / ALTER PUBLICATION / DROP PUBLICATION	Publication lifecycle
SHOW PUBLICATION / SHOW CREATE PUBLICATION	Views publications

Subscriber

Privileges related to creating and viewing subscriptions, such as creating a subscription database from a publication and using SHOW SUBSCRIPTIONS, are controlled by administrative roles and product policies. Read-only access to a subscription database still requires database and table privileges such as SELECT.