GRANT Statement

By default, a user account or a role has no privileges.

If a user or a role has no privileges, it is displayed as [NONE](#none) privilege.

Some queries by their implementation require a set of privileges. For example, to execute the [RENAME](/docs/sql-reference/statements/optimize) query you need the following privileges: `SELECT`, `CREATE TABLE`, `INSERT` and `DROP TABLE`.

### SELECT[​](#select "Direct link to SELECT")

Allows executing [SELECT](/docs/sql-reference/statements/select) queries.

Privilege level: `COLUMN`.

**Description**

User granted with this privilege can execute `SELECT` queries over a specified list of columns in the specified table and database. If user includes other columns then specified a query returns no data.

Consider the following privilege:

```
GRANT SELECT(x,y) ON db.table TO john
```

This privilege allows `john` to execute any `SELECT` query that involves data from the `x` and/or `y` columns in `db.table`, for example, `SELECT x FROM db.table`. `john` can't execute `SELECT z FROM db.table`. The `SELECT * FROM db.table` also is not available. Processing this query, ClickHouse does not return any data, even `x` and `y`. The only exception is if a table contains only `x` and `y` columns, in this case ClickHouse returns all the data.

### INSERT[​](#insert "Direct link to INSERT")

Allows executing [INSERT](/docs/sql-reference/statements/insert-into) queries.

Privilege level: `COLUMN`.

**Description**

User granted with this privilege can execute `INSERT` queries over a specified list of columns in the specified table and database. If user includes other columns then specified a query does not insert any data.

**Example**

```
GRANT INSERT(x,y) ON db.table TO john
```

The granted privilege allows `john` to insert data to the `x` and/or `y` columns in `db.table`.

### ALTER[​](#alter "Direct link to ALTER")

Allows executing [ALTER](/docs/sql-reference/statements/alter) queries according to the following hierarchy of privileges:

- `ALTER`. Level: `COLUMN`.
  - `ALTER TABLE`. Level: `GROUP`
  - `ALTER UPDATE`. Level: `COLUMN`. Aliases: `UPDATE`
  - `ALTER DELETE`. Level: `COLUMN`. Aliases: `DELETE`
  - `ALTER COLUMN`. Level: `GROUP`
  - `ALTER ADD COLUMN`. Level: `COLUMN`. Aliases: `ADD COLUMN`
  - `ALTER DROP COLUMN`. Level: `COLUMN`. Aliases: `DROP COLUMN`
  - `ALTER MODIFY COLUMN`. Level: `COLUMN`. Aliases: `MODIFY COLUMN`
  - `ALTER COMMENT COLUMN`. Level: `COLUMN`. Aliases: `COMMENT COLUMN`
  - `ALTER CLEAR COLUMN`. Level: `COLUMN`. Aliases: `CLEAR COLUMN`
  - `ALTER RENAME COLUMN`. Level: `COLUMN`. Aliases: `RENAME COLUMN`
  - `ALTER INDEX`. Level: `GROUP`. Aliases: `INDEX`
  - `ALTER ORDER BY`. Level: `TABLE`. Aliases: `ALTER MODIFY ORDER BY`, `MODIFY ORDER BY`
  - `ALTER SAMPLE BY`. Level: `TABLE`. Aliases: `ALTER MODIFY SAMPLE BY`, `MODIFY SAMPLE BY`
  - `ALTER ADD INDEX`. Level: `TABLE`. Aliases: `ADD INDEX`
  - `ALTER DROP INDEX`. Level: `TABLE`. Aliases: `DROP INDEX`
  - `ALTER MATERIALIZE INDEX`. Level: `TABLE`. Aliases: `MATERIALIZE INDEX`
  - `ALTER CLEAR INDEX`. Level: `TABLE`. Aliases: `CLEAR INDEX`
  - `ALTER CONSTRAINT`. Level: `GROUP`. Aliases: `CONSTRAINT`
  - `ALTER ADD CONSTRAINT`. Level: `TABLE`. Aliases: `ADD CONSTRAINT`
  - `ALTER DROP CONSTRAINT`. Level: `TABLE`. Aliases: `DROP CONSTRAINT`
  - `ALTER TTL`. Level: `TABLE`. Aliases: `ALTER MODIFY TTL`, `MODIFY TTL`
  - `ALTER MATERIALIZE TTL`. Level: `TABLE`. Aliases: `MATERIALIZE TTL`
  - `ALTER SETTINGS`. Level: `TABLE`. Aliases: `ALTER SETTING`, `ALTER MODIFY SETTING`, `MODIFY SETTING`
  - `ALTER MOVE PARTITION`. Level: `TABLE`. Aliases: `ALTER MOVE PART`, `MOVE PARTITION`, `MOVE PART`
  - `ALTER FETCH PARTITION`. Level: `TABLE`. Aliases: `ALTER FETCH PART`, `FETCH PARTITION`, `FETCH PART`
  - `ALTER FREEZE PARTITION`. Level: `TABLE`. Aliases: `FREEZE PARTITION`
  - `ALTER EXECUTE`. Level: `TABLE`. Aliases: `ALTER TABLE EXECUTE`
  - `ALTER VIEW`. Level: `GROUP`
  - `ALTER VIEW REFRESH`. Level: `VIEW`. Aliases: `REFRESH VIEW`
  - `ALTER VIEW MODIFY QUERY`. Level: `VIEW`. Aliases: `ALTER TABLE MODIFY QUERY`
  - `ALTER VIEW MODIFY SQL SECURITY`. Level: `VIEW`. Aliases: `ALTER TABLE MODIFY SQL SECURITY`

Examples of how this hierarchy is treated:

- The `ALTER` privilege includes all other `ALTER*` privileges.
- `ALTER CONSTRAINT` includes `ALTER ADD CONSTRAINT` and `ALTER DROP CONSTRAINT` privileges.

**Notes**

- The `MODIFY SETTING` privilege allows modifying table engine settings. It does not affect settings or server configuration parameters.
- The `ATTACH` operation needs the [CREATE](#create) privilege.
- The `DETACH` operation needs the [DROP](#drop) privilege.
- To stop mutation by the [KILL MUTATION](/docs/sql-reference/statements/kill#kill-mutation) query, you need to have a privilege to start this mutation. For example, if you want to stop the `ALTER UPDATE` query, you need the `ALTER UPDATE`, `ALTER TABLE`, or `ALTER` privilege.

### BACKUP[​](#backup "Direct link to BACKUP")

Allows execution of [`BACKUP`] in queries. For more information on backups see ["Backup and Restore"](/docs/operations/backup/overview).

### CREATE[​](#create "Direct link to CREATE")

Allows executing [CREATE](/docs/sql-reference/statements/create) and [ATTACH](/docs/sql-reference/statements/attach) DDL-queries according to the following hierarchy of privileges:

- `CREATE`. Level: `GROUP`
  - `CREATE DATABASE`. Level: `DATABASE`
  - `CREATE TABLE`. Level: `TABLE`
    - `CREATE ARBITRARY TEMPORARY TABLE`. Level: `GLOBAL`
      - `CREATE TEMPORARY TABLE`. Level: `GLOBAL`
  - `CREATE VIEW`. Level: `VIEW`
  - `CREATE DICTIONARY`. Level: `DICTIONARY`

**Notes**

- To delete the created table, a user needs [DROP](#drop).

### CLUSTER[​](#cluster "Direct link to CLUSTER")

Allows executing `ON CLUSTER` queries.

```
GRANT CLUSTER ON *.* TO <username>
```

By default, queries with `ON CLUSTER` require the user to have the `CLUSTER` grant.
You will get the following error if you to try to use `ON CLUSTER` in a query without first granting the `CLUSTER` privilege:

```
Not enough privileges. To execute this query, it's necessary to have the grant CLUSTER ON *.*.
```

The default behavior can be changed by setting the `on_cluster_queries_require_cluster_grant` setting,
located in the `access_control_improvements` section of `config.xml` (see below), to `false`.

```
<access_control_improvements>
    <on_cluster_queries_require_cluster_grant>true</on_cluster_queries_require_cluster_grant>
</access_control_improvements>
```

### DROP[​](#drop "Direct link to DROP")

Allows executing [DROP](/docs/sql-reference/statements/drop) and [DETACH](/docs/sql-reference/statements/detach) queries according to the following hierarchy of privileges:

- `DROP`. Level: `GROUP`
  - `DROP DATABASE`. Level: `DATABASE`
  - `DROP TABLE`. Level: `TABLE`
  - `DROP VIEW`. Level: `VIEW`
  - `DROP DICTIONARY`. Level: `DICTIONARY`

### TRUNCATE[​](#truncate "Direct link to TRUNCATE")

Allows executing [TRUNCATE](/docs/sql-reference/statements/truncate) queries.

Privilege level: `TABLE`.

### OPTIMIZE[​](#optimize "Direct link to OPTIMIZE")

Allows executing [OPTIMIZE TABLE](/docs/sql-reference/statements/optimize) queries.

Privilege level: `TABLE`.

### SHOW[​](#show "Direct link to SHOW")

Allows executing `SHOW`, `DESCRIBE`, `USE`, and `EXISTS` queries according to the following hierarchy of privileges:

- `SHOW`. Level: `GROUP`
  - `SHOW DATABASES`. Level: `DATABASE`. Allows to execute `SHOW DATABASES`, `SHOW CREATE DATABASE`, `USE <database>` queries.
  - `SHOW TABLES`. Level: `TABLE`. Allows to execute `SHOW TABLES`, `EXISTS <table>`, `CHECK <table>` queries.
  - `SHOW COLUMNS`. Level: `COLUMN`. Allows to execute `SHOW CREATE TABLE`, `DESCRIBE` queries.
  - `SHOW DICTIONARIES`. Level: `DICTIONARY`. Allows to execute `SHOW DICTIONARIES`, `SHOW CREATE DICTIONARY`, `EXISTS <dictionary>` queries.

**Notes**

A user has the `SHOW` privilege if it has any other privilege concerning the specified table, dictionary or database.

### KILL QUERY[​](#kill-query "Direct link to KILL QUERY")