> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lancedb.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authorization

> Who may do what: an overview of LanceDB Enterprise's access control model.

**Applies to:** Embedded ❌, Enterprise ✅

[Authentication](https://docs.lancedb.com/enterprise/authentication.md) establishes who is calling.
Authorization decides what they may do.

An access control entry grants **one privilege** on **one object** to **one
subject**. Everything on the Principals and Privileges pages is a
consequence of that shape.

## Granting a privilege

`GRANT` and `REVOKE` cover every object in the catalog -- system, database,
schema/namespace, table, view, materialized view, secret, function, and
storage integration. A Secret, the one a day-to-day user shares most
often, looks like this:

```sql SQL icon="database" theme={"theme":{"light":"vitesse-light","dark":"catppuccin-mocha"}}
GRANT USAGE ON SECRET platform.`openai-prod` TO ROLE research
REVOKE USAGE ON SECRET platform.`openai-prod` FROM ROLE research
```

The caller must already hold `OWNERSHIP` on the object being granted (`GRANT`
additionally requires the object to already exist; `REVOKE` does not, so an
entry left on a dropped object can still be removed). A role need not exist
beforehand, but a `USER` or `GROUP` name must resolve to exactly one identity
in your identity provider, or the statement fails.

See [Privileges](https://docs.lancedb.com/governance/privileges.md) for the full statement syntax and
every privilege each operation needs. See [Principals](https://docs.lancedb.com/governance/principals.md)
for who a grant can name.

## What to read next

> [card] [Principals](https://docs.lancedb.com/governance/principals.md)
>
> Users, groups, and roles -- where each comes from, and how a grant names one.

> [card] [Privileges](https://docs.lancedb.com/governance/privileges.md)
>
> Every object's privileges, and the GRANT/REVOKE syntax that covers them.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.