Skip to documentation
OriginChainDB Docs
Ask AI
Queries

Roles and permissions

Use the current console guide for live instance workflows and availability. Screenshots below illustrate the demo workspace with sample data. In the signed-in console, actions operate on the selected instance when your role and its capabilities allow them.

Manage organization membership separately from database roles and grants.

The signed-in console applies authorized changes through the service and displays their returned status. The public demo stores local drafts and sends no invitation emails.

1. Review your team

Return to the organization and open Team. Choose Invite member, enter an email and select an available organization role. In the signed-in console, invitations are emailed. Demo invitations remain in the browser.

Review your teamOriginChainDB console
Current organization Team page with member roles and the notice that preview changes do not send invitation emails. Current organization Team page with member roles and the notice that preview changes do not send invitation emails.
Demo illustration: the current organization Team page identifies its changes as local preview data.Current console · Dark theme · Local preview
Review your team
Current organization Team page with member roles and the notice that preview changes do not send invitation emails. Current organization Team page with member roles and the notice that preview changes do not send invitation emails.

Actual local console with sample data. No production database is connected.

2. Open Roles & grants

Select an instance and open Access Control → Roles & grants. Review the roles, inherited roles and grants returned by that instance. Read the permission explanation if an action is unavailable.

Open Roles and grantsOriginChainDB console
Current Access Control Roles and grants page showing local role drafts and the full instance sidebar. Current Access Control Roles and grants page showing local role drafts and the full instance sidebar.
Demo illustration: roles & grants lists access proposals for the selected instance, not live database grants.Current console · Dark theme · Local preview
Open Roles and grants
Current Access Control Roles and grants page showing local role drafts and the full instance sidebar. Current Access Control Roles and grants page showing local role drafts and the full instance sidebar.

Actual local console with sample data. No production database is connected.

3. Create a database role

  1. Choose New role, enter its name and select any roles it inherits.
  2. After creation, choose Grant access for that role.
  3. Select the object and permissions available in the grant editor. Add column masks where required.
  4. Save the grant and review the state returned by the instance. Test access using the intended database identity.
Prepare a role draftOriginChainDB console
New role draft dialog showing a proposed namespace, table, query shape, and permission grant over the current Access Control page. New role draft dialog showing a proposed namespace, table, query shape, and permission grant over the current Access Control page.
Demo illustration: a role proposal scopes each grant by namespace, table, query shape, and permission.Current console · Dark theme · Local preview
Prepare a role draft
New role draft dialog showing a proposed namespace, table, query shape, and permission grant over the current Access Control page. New role draft dialog showing a proposed namespace, table, query shape, and permission grant over the current Access Control page.

Actual local console with sample data. No production database is connected.

Broad object scopes can include more tables than one named object. Review those scopes and inherited roles before granting access. Built-in roles cannot be deleted.

4. Verify effective access

Use the connected Effective access view to inspect access for a database identity. In the demo, the similarly named analyzer evaluates local role proposals only.

Verify table grants, inherited roles, row policies and column masks as the intended identity. The demo’s Proposed or Not proposed labels do not establish a live security boundary.

A database role belongs to the database identity layer. Organization Team membership does not provide database permissions. See database identities and the enforcement boundary before applying a proposal.

Edit or remove access

Return to Roles & grants to edit or revoke a grant. Deleting a custom role requires typing its name and may be unavailable under the current action policy. Read the confirmation and check the returned result before assuming access has changed.

Use the connected organization’s role catalog and permission explanations for its current capabilities. Team membership controls console access; database identities, roles and grants control access to the database. A permission shown in a browser is not a substitute for server enforcement.

Apply through an authenticated service

Review exported scopes, resolve database identities, and verify enforcement for SQL, vector, full-text, graph, and direct record requests. A browser draft is not evidence that a user is restricted.

Removing a member or leaving an organization revokes that member’s personal instance tokens. Read the Team page’s confirmation status across the organization’s instances. Use Check again or Retry now for unconfirmed revocations. Organization API keys remain separate and are not revoked by member removal; review shared credentials and database identities separately.

Next: prepare row policies and check the live enforcement boundary.