Access policy permissions

Use this page to choose permissions when you create an access policy. The permissions table in the form changes with the Resource type you select.

Permissions by resource type

Permission	Applies to	catalog	schema	table	function
SELECT	Tables	Yes	Yes	Yes	—
INSERT + UPDATE	Tables	Yes	Yes	Yes	—
ALTER	Tables	Yes	Yes	Yes	—
DELETE	Tables	Yes	Yes	Yes	—
DROP	Tables	Yes	Yes	Yes	—
CREATE	Schemas	Yes	Yes	—	—
DROP	Schemas	Yes	Yes	—	—
VIEW DDL	Schemas and tables	Yes	Yes	Yes	—
ALL	Everything above	Yes	Yes	Yes	—
VIEW_METADATA	Metadata tables	Yes	Yes	Yes	—
CREATE	Functions	—	—	—	Yes
DROP	Functions	—	—	—	Yes
VIEW DDL	Functions	—	—	—	Yes
EXECUTE	Functions	—	—	—	Yes

What each permission allows

Permission	Allows	Does not allow
SELECT	Read rows from tables and views.	Changing data.
INSERT + UPDATE	Add rows and change existing rows. One permission covers both.	Deleting rows.
ALTER	Change a table: add, rename, or drop columns, change table properties, refresh a materialized view.	Reading or changing rows.
DELETE	Delete rows from tables and empty a table.	Deleting the table, schema, or catalog.
DROP on tables	Delete tables, views, and materialized views.	—
CREATE on schemas	Create tables, views, and materialized views in the schema.	—
DROP on schemas	Delete schemas.	—
VIEW DDL	See the CREATE statement of a schema, table, or function.	Seeing objects that the person has no other access to.
ALL	Every permission in the list for that level.	Function permissions.
EXECUTE	Run the functions in the schema.	Creating or deleting functions.
VIEW_METADATA	Query the metadata tables that come with a table.	—

How the level changes the reach

• At catalog level, table permissions apply to every table in every schema of the catalog, including tables created later.
• At schema level, table permissions apply to every table in the schema, including tables created later.
• At table level, permissions apply only to the tables you select.

warning

DELETE and ALL at catalog or schema level let people delete rows in every table inside. Grant them only to people who load or clean data.

Good to know

• No permission blocks access. A person gets the sum of every policy they are in.
• Any active permission on a catalog also lets the person query its information_schema. You do not see or manage this in Data Security.
• VIEW DDL does not decide what a person sees in the tree. A person sees an object when they have any permission on it or on an object below it.

Next steps

• Grant data access with an access policy.