# Privilege Categories


This page provides a quick reference to SQL privilege categories **within a MatrixOne instance (tenant)**. To create users, bind roles, and perform console operations, see [Permissions · MatrixOne](../../guides/matrixone/permissions.md).
For AI Studio workspace roles and platform privilege points, see [User Permissions](../../guides/ai-studio/permissions/index.md) and [Permission Reference](../permissions/index.md). They use a different model.

## Key concepts

- Privileges are granted to **roles**, and roles are then granted to **users**. A user without a role cannot perform operations.
- Objects have an **Owner**. The Owner can manage privileges on the object through discretionary access control.
- The administrator created with an instance has the broadest management capabilities. Instances cannot access one another's tenant resources.

## Administrator (Account) level

| Privilege | Meaning |
| --- | --- |
| `CREATE USER` / `DROP USER` / `ALTER USER` | User lifecycle |
| `CREATE ROLE` / `DROP ROLE` | Role lifecycle |
| `CREATE DATABASE` / `DROP DATABASE` | Database lifecycle |
| `SHOW DATABASES` | Lists databases in the tenant |
| `CONNECT` | Allows connection-side operations that do not depend on a specific object, such as `USE`, and some object-free `SELECT` operations |
| `MANAGE GRANTS` | Manages grants and role inheritance |
| `ALL [PRIVILEGES]` / `OWNERSHIP` | All tenant-level privileges. `OWNERSHIP` can be used with `WITH GRANT OPTION`. |

## User level

| Privilege | Meaning |
| --- | --- |
| `OWNERSHIP` (user object) | Manages the user, including information, password, and deletion, and can grant this privilege onward |

## Role level

| Privilege | Meaning |
| --- | --- |
| `OWNERSHIP` (role object) | Manages the role, including its name, description, and deletion, and can grant this privilege onward |

## Database level

| Privilege | Meaning |
| --- | --- |
| `SHOW TABLES` | Lists tables in the database |
| `CREATE TABLE` / `DROP TABLE` | Table lifecycle |
| `CREATE VIEW` / `DROP VIEW` / `ALTER VIEW` | Views |
| `ALTER TABLE` | Alters tables |
| `ALL` / `OWNERSHIP` | All privileges on the database. `OWNERSHIP` can be granted onward. |

## Table level

| Privilege | Meaning |
| --- | --- |
| `SELECT` / `INSERT` / `UPDATE` / `DELETE` / `TRUNCATE` | Reads, writes, and clears data |
| `REFERENCE` | Uses the table as a foreign-key target and views its structure with `DESCRIBE` / `SHOW` |
| `INDEX` | Creates or drops indexes |
| `ALL` / `OWNERSHIP` | All privileges on the table. `OWNERSHIP` can be granted onward. |

## Execution

| Privilege | Meaning |
| --- | --- |
| `EXECUTE` | Executes a function or stored procedure |

## Publication and subscription

Data sharing across instances, including multiple instances under the same account. Historically, documentation limits most **publication and subscription operations to administrative roles such as `moadmin` / `accountadmin`**. Refer to the current instance's role capabilities.

**Publisher**

| Privilege | Meaning |
| --- | --- |
| `CREATE PUBLICATION` / `ALTER PUBLICATION` / `DROP PUBLICATION` | Publication lifecycle |
| `SHOW PUBLICATION` / `SHOW CREATE PUBLICATION` | Views publications |

**Subscriber**

Privileges related to creating and viewing subscriptions, such as creating a subscription database from a publication and using `SHOW SUBSCRIPTIONS`, are controlled by administrative roles and product policies. Read-only access to a subscription database still requires database and table privileges such as `SELECT`.