---
title: "Role-based access overview"
url: "https://docs.yugabyte.com/stable/secure/authorization/rbac-model-ycql/"
---

# Role-based access overview

Overview of the role-based access control (RBAC) model in YCQL.

How role-based access control works

Role-based access control (RBAC) consists of a collection of permissions on resources given to roles.

- [YSQL](/stable/secure/authorization/rbac-model/)
- [YCQL](/stable/secure/authorization/rbac-model-ycql/)

## Roles

Roles in YCQL can represent individual users or a group of users. They encapsulate a set of permissions that can be assigned to other roles (or users). Roles are essential to implementing and administering access control on a YugabyteDB cluster. Below are some important points about roles:

- Roles which have login permission are users. Hence, all users are roles but all roles are not users.
- Roles can be granted to other roles, making it possible to organize roles into a hierarchy.
- Roles inherit the permissions of all other roles granted to them.

## Resources

YCQL defines a number of specific resources, that represent underlying database objects. A resource can denote one object or a collection of objects. YCQL resources are hierarchical as described below:

- Keyspaces and tables follow the hierarchy: `ALL KEYSPACES` > `KEYSPACE` > `TABLE`
- ROLES are hierarchical (they can be assigned to other roles). They follow the hierarchy: `ALL ROLES` > `ROLE #1` > `ROLE #2` ...

The table below lists out the various resources.

| Resource        | Description                                                                                   |
|-----------------|-----------------------------------------------------------------------------------------------|
| `KEYSPACE`      | Denotes one keyspace. Typically includes all the tables and indexes defined in that keyspace. |
| `TABLE`         | Denotes one table. Includes all the indexes defined on that table.                            |
| `ROLE`          | Denotes one role.                                                                             |
| `ALL KEYSPACES` | Collection of all keyspaces in the database.                                                  |
| `ALL ROLES`     | Collection of all roles in the database.                                                      |

## Permissions

Permissions are necessary to execute operations on database objects. Permissions can be granted at any level of the database hierarchy and are inherited downwards. The set of permissions include:

| Permission                   | Objects                      | Operations                          |
|------------------------------|------------------------------|-------------------------------------|
| `ALTER`                      | keyspace, table, role        | ALTER                               |
| `AUTHORIZE`                  | keyspace, table, role        | GRANT PERMISSION, REVOKE PERMISSION |
| `CREATE`                     | keyspace, table, role, index | CREATE                              |
| `DROP`                       | keyspace, table, role, index | DROP                                |
| `MODIFY`                     | keyspace, table              | INSERT, UPDATE, DELETE, TRUNCATE    |
| `SELECT`                     | keyspace, table              | SELECT                              |
| `DESCRIBE` (not implemented) | role                         | LIST ROLES                          |

Note

The `ALTER` permission on the base table is required in order to CREATE or DROP indexes on it.

Read more about [permissions in YCQL](/stable/api/ycql/ddl_grant_permission/#permissions "permissions in YCQL").