Repository: ydb-platform/ydb
Pull request #15413: SysView Auth Documentation (en)
Author: login: kungasc
Labels: name: documentation
description: Improvements or additions to documentation
name: changelog/f25-3
description: PR участвует в списке изменений
Created: 2025-03-06T13:22:00Z | Merged: 2025-03-19T11:35:53Z

### Changelog entry <!-- a user-readable short description of changes introduced in this PR -->

Added new auth sys views

### Changelog category <!-- remove all except one -->

* Documentation

### Additional information

...



Diff:
diff --git a/ydb/docs/en/core/concepts/glossary.md b/ydb/docs/en/core/concepts/glossary.md
index 07d8fdf77949..4a10e38c7ed6 100644
--- a/ydb/docs/en/core/concepts/glossary.md
+++ b/ydb/docs/en/core/concepts/glossary.md
@@ -280,6 +280,10 @@ An access subject can be a [user](#access-user) or a [group](#access-group).
 
 An **[access right](../security/authorization.md#right)** is an entity that represents permission for an [access subject](#access-subject) to perform a specific set of operations in a cluster or database on a specific [access object](#access-object).
 
+### Access right inheritance {#access-right-inheritance}
+
+**Access right inheritance** refers to the mechanism by which [access rights](#access-right) are automatically passed down from parent [access objects](#access-object) to child access objects within a database structure. This ensures that permissions granted at a higher level in the hierarchy are applied to all sub-levels beneath it, unless [explicitly overridden](../reference/ydb-cli/commands/scheme-permissions.md#clear-inheritance).
+
 ### Access control list {#access-control-list}
 
 An **access control list** or **ACL** is a list of all [rights](#access-right) granted to [access subjects](#access-subject) (users and groups) for a specific [access object](#access-object).
diff --git a/ydb/docs/en/core/dev/system-views.md b/ydb/docs/en/core/dev/system-views.md
index d290aefc90c7..747c4a69a5ac 100644
--- a/ydb/docs/en/core/dev/system-views.md
+++ b/ydb/docs/en/core/dev/system-views.md
@@ -10,6 +10,7 @@ DB system views contain:
 * [Top queries by certain characteristics](#top-queries).
 * [Query details](#query-metrics).
 * [History of overloaded partitions](#top-overload-partitions).
+* [Access control entities](#auth).
 
 {% note info %}
 
@@ -29,8 +30,8 @@ Cumulative fields (`RowReads`, `RowUpdates`, and so on) store the accumulated va
 
 Table structure:
 
-| Field | Description |
---- | ---
+| Column | Description |
+|--------|-------------|
 | `OwnerId` | ID of the SchemeShard serving the table.<br/>Type: `Uint64`.<br/>Key: `0`. |
 | `PathId` | ID of the SchemeShard path.<br/>Type: `Uint64`.<br/>Key: `1`. |
 | `PartIdx` | Partition sequence number.<br/>Type: `Uint64`.<br/>Key: `2`. |
@@ -99,10 +100,10 @@ Fields that provide information about the used CPU time (...`CPUTime`) are expre
 
 Query text limit is 4 KB.
 
-All tables have the same set of fields:
+All tables have the same structure:
 
-| Field | Description |
---- | ---
+| Column | Description |
+|--------|-------------|
 | `IntervalEnd` | The end of a one-minute or one-hour interval.<br/>Type: `Timestamp`.<br/>Key: `0`. |
 | `Rank` | Rank of a top query.<br/>Type: `Uint32`.<br/>Key: `1`. |
 | `QueryText` | Query text.<br/>Type: `Utf8`. |
@@ -180,8 +181,8 @@ Restrictions:
 
 Table structure:
 
-| Field | Description |
----|---
+| Column | Description |
+|--------|-------------|
 | `IntervalEnd` | The end of a one-minute interval.<br/>Type: `Timestamp`.<br/>Key: `0`. |
 | `Rank` | Query rank within an interval (by the SumCPUTime field).<br/>Type: `Uint32`.<br/>Key: `1`. |
 | `QueryText` | Query text.<br/>Type: `Utf8`. |
@@ -248,10 +249,10 @@ The following system views (tables) store the history of points in time when the
 
 These tables contain partitions with peak loads of more than 70% (`CPUCores` > 0.7). Partitions within a single interval are ranked by peak load value.
 
-Both tables have the same set of fields:
+All tables have the same structure:
 
-| Field | Description |
---- | ---
+| Column | Description |
+|--------|-------------|
 | `IntervalEnd` | The end of a one-minute or one-hour interval.<br/>Type: `Timestamp`.<br/>Key: `0`. |
 | `Rank` | Partition rank within an interval (by CPUCores).<br/>Type: `Uint32`.<br/>Key: `1`. |
 | `TabletId` | ID of the tablet serving the partition.<br/>Type: `Uint64`. |
@@ -299,3 +300,109 @@ ORDER BY IntervalEnd desc, CPUCores desc
 ```
 
 * `"YYYY-MM-DDTHH:MM:SS.UUUUUUZ"`: Time in the UTC 0 zone (`YYYY` stands for year, `MM`, for month, `DD`, for date, `hh`, for hours, `mm`, for minutes, `ss`, for seconds, and `uuuuuu`, for microseconds). For example, `"2023-01-26T13:00:00.000000Z"`.
+
+## Access control entities {#auth}
+
+The following system views store data for analyzing various [access control entities](../security/authorization.md).
+
+### Auth users
+
+The `auth_users` view lists internal {{ ydb-short-name }} [users](../concepts/glossary.md#access-user). It does not include users authenticated through external systems such as LDAP.
+
+This view can be fully accessed by administrators, while regular users can only view their own details.
+
+Table structure:
+
+| Column | Description |
+|--------|-------------|
+| `Sid` | [SID](../concepts/glossary.md#sid) of the user.<br />Type: `Utf8`.<br />Key: `0`. |
+| `IsEnabled` | Indicates if login is allowed; used for explicit administrator block. Independent of `IsLockedOut`.<br />Type: `Bool`. |
+| `IsLockedOut` | Automatically locked out due to exceeding failed login attempts. Independent of `IsEnabled`.<br />Type: `Bool`. |
+| `CreatedAt` | Timestamp of user creation.<br />Type: `Timestamp`. |
+| `LastSuccessfulAttemptAt` | Timestamp of the last successful login attempt.<br />Type: `Timestamp`. |
+| `LastFailedAttemptAt` | Timestamp of the last failed login attempt.<br />Type: `Timestamp`. |
+| `FailedAttemptCount` | Number of failed login attempts.<br />Type: `Uint32`. |
+| `PasswordHash` | JSON string containing password hash, salt, and hash algorithm.<br />Type: `Utf8`. |
+
+### Auth groups
+
+The `auth_groups` view lists [access groups](../concepts/glossary.md#access-group).
+
+This view can be accessed only by administrators.
+
+Table structure:
+
+| Column | Description |
+|--------|-------------|
+| `Sid` | [SID](../concepts/glossary.md#sid) of the group.<br />Type: `Utf8`.<br />Key: `0`. |
+
+### Auth group members
+
+The `auth_group_members` view lists membership details within [access groups](../concepts/glossary.md#access-group).
+
+This view can be accessed only by administrators.
+
+Table structure:
+
+| Column | Description |
+|--------|-------------|
+| `GroupSid` | SID of the group.<br />Type: `Utf8`.<br />Key: `0`. |
+| `MemberSid` | SID of the group member.<br />Type: `Utf8`.<br />Key: `1`. |
+
+### Auth permissions
+
+The auth permissions views list assigned [access rights](../concepts/glossary.md#access-right).
+
+Contains two views:
+
+* `auth_permissions`: Directly assigned access rights.
+* `auth_effective_permissions`: Effective access rights, accounting for [inheritance](../concepts/glossary.md#access-right-inheritance).
+
+A user can view an [access object](../concepts/glossary.md#access-object) in the results if they have the `ydb.granular.describe_schema` permission on it.
+
+Table structure:
+
+| Column | Description |
+|--------|-------------|
+| `Path` | Path to the access object.<br />Type: `Utf8`.<br />Key: `0`. |
+| `Sid` | SID of the [access subject](../concepts/glossary.md#access-subject).<br />Type: `Utf8`.<br />Key: `1`. |
+| `Permission` | Name of the {{ ydb-short-name }} [access right](../yql/reference/syntax/grant.md#permissions-list).<br />Type: `Utf8`.<br />Key: `2`. |
+
+#### Example queries
+
+All the directly assigned permissions for the table located at the path `my_table`:
+
+```yql
+SELECT *
+FROM `.sys/auth_permissions`
+WHERE Path = "my_table"
+```
+
+All the effective permissions for the table located at the path `my_table`, including inherited permissions:
+
+```yql
+SELECT *
+FROM `.sys/auth_effective_permissions`
+WHERE Path = "my_table"
+```
+
+All permissions directly assigned to the user identified as `user3`:
+
+```yql
+SELECT *
+FROM `.sys/auth_permissions`
+WHERE Sid = "user3"
+```
+
+### Auth owners
+
+The `auth_owners` view lists details of [access objects](../concepts/glossary.md#access-object) [ownership](../concepts/glossary.md#access-owner).
+
+A user can view an [access object](../concepts/glossary.md#access-object) in the results if they have the `ydb.granular.describe_schema` permission on it.
+
+Table structure:
+
+| Column | Description |
+|--------|-------------|
+| `Path` | Path to the access object.<br />Type: `Utf8`.<br />Key: `0`. |
+| `Sid` | SID of the access object owner.<br />Type: `Utf8`. |


Reviews:
user: login: azevaykin
state: COMMENTED
author_association: COLLABORATOR
submitted_at: 2025-03-07T08:29:18Z
user: login: kungasc
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-07T08:33:32Z
user: login: kungasc
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-07T08:35:11Z
user: login: kungasc
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-07T08:35:18Z
user: login: azevaykin
state: DISMISSED
author_association: COLLABORATOR
submitted_at: 2025-03-07T09:01:25Z
user: login: blinkov
state: DISMISSED
author_association: CONTRIBUTOR
submitted_at: 2025-03-10T06:18:11Z
user: login: kungasc
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-10T08:29:07Z
user: login: kungasc
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-10T09:10:41Z
user: login: ijon
state: COMMENTED
author_association: COLLABORATOR
submitted_at: 2025-03-10T10:24:44Z
user: login: kungasc
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-10T11:28:46Z
user: login: kungasc
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-10T11:30:57Z
user: login: kungasc
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-19T11:31:11Z
user: login: fomichev3000
state: APPROVED
author_association: MEMBER
submitted_at: 2025-03-19T11:35:51Z

Review comments:
diff_hunk: @@ -299,3 +300,109 @@ ORDER BY IntervalEnd desc, CPUCores desc
 ```
 
 * `"YYYY-MM-DDTHH:MM:SS.UUUUUUZ"`: Time in the UTC 0 zone (`YYYY` stands for year, `MM`, for month, `DD`, for date, `hh`, for hours, `mm`, for minutes, `ss`, for seconds, and `uuuuuu`, for microseconds). For example, `"2023-01-26T13:00:00.000000Z"`.
+
+## Access control entities {#auth}
+
+The following system views store data for analyzing various [access control entities](../security/authorization.md).
+
+### Auth users
+
+The `auth_users` view lists internal {{ ydb-short-name }} [users](../concepts/glossary.md#access-user). It does not include users authenticated through external systems such as LDAP.
+
+This view can be fully accessed by database administrators, while regular users can only view their own details.
+
+Table Structure:
+
+| Column | Description |
+|--------|-------------|
+| `Sid` | SID of the user.<br />Type: `Utf8`.<br />Key: `0`. |
+| `IsEnabled` | Indicates if login is allowed; used for explicit administrator block. Independent of `IsLockedOut`.<br />Type: `Bool`. |
+| `IsLockedOut` | Automatically locked out due to exceeding failed login attempts. Independent of `IsEnabled`.<br />Type: `Bool`. |
+| `CreatedAt` | Timestamp of user creation.<br />Type: `Timestamp`. |
+| `LastSuccessfulAttemptAt` | Timestamp of the last successful login attempt.<br />Type: `Timestamp`. |
+| `LastFailedAttemptAt` | Timestamp of the last failed login attempt.<br />Type: `Timestamp`. |
+| `FailedAttemptCount` | Number of failed login attempts.<br />Type: `Uint32`. |
+| `PasswordHash` | JSON string containing password hash, salt, and hash algorithm.<br />Type: `Utf8`. |
+
+### Auth groups
+
+The `auth_groups` view lists [access groups](../concepts/glossary.md#access-group).
+
+This view can be accessed only by database administrators.
+
+Table Structure:
+
+| Column | Description |
+|--------|-------------|
+| `Sid` | SID of the group.<br />Type: `Utf8`.<br />Key: `0`. |
+
+### Auth group members
+
+The `auth_group_members` view lists membership details within [access groups](../concepts/glossary.md#access-group).
+
+This view can be accessed only by database administrators.
+
+Table Structure:
+
+| Column | Description |
+|--------|-------------|
+| `GroupSid` | SID of the group.<br />Type: `Utf8`.<br />Key: `0`. |
+| `MemberSid` | SID of the group member.<br />Type: `Utf8`.<br />Key: `1`. |
+
+### Auth permissions
+
+The auth permissions views list assigned [access rights](../concepts/glossary.md#access-right).
+
+Contains two views:
+
+* `auth_permissions`: Directly assigned access rights.
+* `auth_effective_permissions`: Effective access rights, accounting for inheritance.
+
+A user can view an [access object](../concepts/glossary.md#access-object) in the results if they have the `ydb.granular.describe_schema` permission on it.
+
+Table Structure:
+
+| Column | Description |
+|--------|-------------|
+| `Path` | Path to the access object.<br />Type: `Utf8`.<br />Key: `0`. |
+| `Sid` | SID of the [access subject](../concepts/glossary.md#access-subject).<br />Type: `Utf8`.<br />Key: `1`. |
+| `Permission` | Name of the {{ ydb-short-name }} [access right](../yql/reference/syntax/grant.md#permissions-list).<br />Type: `Utf8`.<br />Key: `2`. |
+
+#### Example queries
+
+All the directly assigned permissions for the table located at the path `/Root/my_table`:
+
+```yql
+SELECT *
+    FROM `/Root/.sys/auth_permissions`
+    WHERE Path = "/Root/my_table"
+```
+
+All the effective permissions for the table located at the path `/Root/my_table`, including inherited permissions:
+
+```yql
+SELECT *
+    FROM `/Root/.sys/auth_effective_permissions`
+    WHERE Path = "/Root/my_table"
+```
+
+All permissions directly assigned to the user identified as `user3`:
+
+```yql
+SELECT *
+    FROM `/Root/.sys/auth_permissions`
+    WHERE Sid = "user3"
+```
+
+### Auth owners
+
+The `auth_owners` view lists details of [access objects](../concepts/glossary.md#access-object) ownership.
path: ydb/docs/en/core/dev/system-views.md
user: login: azevaykin
body: A link to the owner in glossary
created_at: 2025-03-07T08:24:41Z
author_association: COLLABORATOR
diff_hunk: @@ -299,3 +300,109 @@ ORDER BY IntervalEnd desc, CPUCores desc
 ```
 
 * `"YYYY-MM-DDTHH:MM:SS.UUUUUUZ"`: Time in the UTC 0 zone (`YYYY` stands for year, `MM`, for month, `DD`, for date, `hh`, for hours, `mm`, for minutes, `ss`, for seconds, and `uuuuuu`, for microseconds). For example, `"2023-01-26T13:00:00.000000Z"`.
+
+## Access control entities {#auth}
+
+The following system views store data for analyzing various [access control entities](../security/authorization.md).
+
+### Auth users
+
+The `auth_users` view lists internal {{ ydb-short-name }} [users](../concepts/glossary.md#access-user). It does not include users authenticated through external systems such as LDAP.
+
+This view can be fully accessed by database administrators, while regular users can only view their own details.
+
+Table Structure:
+
+| Column | Description |
+|--------|-------------|
+| `Sid` | SID of the user.<br />Type: `Utf8`.<br />Key: `0`. |
+| `IsEnabled` | Indicates if login is allowed; used for explicit administrator block. Independent of `IsLockedOut`.<br />Type: `Bool`. |
+| `IsLockedOut` | Automatically locked out due to exceeding failed login attempts. Independent of `IsEnabled`.<br />Type: `Bool`. |
+| `CreatedAt` | Timestamp of user creation.<br />Type: `Timestamp`. |
+| `LastSuccessfulAttemptAt` | Timestamp of the last successful login attempt.<br />Type: `Timestamp`. |
+| `LastFailedAttemptAt` | Timestamp of the last failed login attempt.<br />Type: `Timestamp`. |
+| `FailedAttemptCount` | Number of failed login attempts.<br />Type: `Uint32`. |
+| `PasswordHash` | JSON string containing password hash, salt, and hash algorithm.<br />Type: `Utf8`. |
+
+### Auth groups
+
+The `auth_groups` view lists [access groups](../concepts/glossary.md#access-group).
+
+This view can be accessed only by database administrators.
+
+Table Structure:
+
+| Column | Description |
+|--------|-------------|
+| `Sid` | SID of the group.<br />Type: `Utf8`.<br />Key: `0`. |
+
+### Auth group members
+
+The `auth_group_members` view lists membership details within [access groups](../concepts/glossary.md#access-group).
+
+This view can be accessed only by database administrators.
+
+Table Structure:
+
+| Column | Description |
+|--------|-------------|
+| `GroupSid` | SID of the group.<br />Type: `Utf8`.<br />Key: `0`. |
+| `MemberSid` | SID of the group member.<br />Type: `Utf8`.<br />Key: `1`. |
+
+### Auth permissions
+
+The auth permissions views list assigned [access rights](../concepts/glossary.md#access-right).
+
+Contains two views:
+
+* `auth_permissions`: Directly assigned access rights.
+* `auth_effective_permissions`: Effective access rights, accounting for inheritance.
+
+A user can view an [access object](../concepts/glossary.md#access-object) in the results if they have the `ydb.granular.describe_schema` permission on it.
+
+Table Structure:
+
+| Column | Description |
+|--------|-------------|
+| `Path` | Path to the access object.<br />Type: `Utf8`.<br />Key: `0`. |
+| `Sid` | SID of the [access subject](../concepts/glossary.md#access-subject).<br />Type: `Utf8`.<br />Key: `1`. |
+| `Permission` | Name of the {{ ydb-short-name }} [access right](../yql/reference/syntax/grant.md#permissions-list).<br />Type: `Utf8`.<br />Key: `2`. |
+
+#### Example queries
+
+All the directly assigned permissions for the table located at the path `/Root/my_table`:
+
+```yql
+SELECT *
+    FROM `/Root/.sys/auth_permissions`
+    WHERE Path = "/Root/my_table"
+```
+
+All the effective permissions for the table located at the path `/Root/my_table`, including inherited permissions:
+
+```yql
+SELECT *
+    FROM `/Root/.sys/auth_effective_permissions`
+    WHERE Path = "/Root/my_table"
+```
+
+All permissions directly assigned to the user identified as `user3`:
+
+```yql
+SELECT *
+    FROM `/Root/.sys/auth_permissions`
+    WHERE Sid = "user3"
+```
+
+### Auth owners
+
+The `auth_owners` view lists details of [access objects](../concepts/glossary.md#access-object) ownership.
+
+A user can view an [access object](../concepts/glossary.md#access-object) in the results if they have the `ydb.granular.describe_schema` permission on it.
+
+Table Structure:
+
+| Column | Description |
+|--------|-------------|
+| `Path` | Path to the access object.<br />Type: `Utf8`.<br />Key: `0`. |
+| `Sid` | SID of the access object owner.<br />Type: `Utf8`. |
path: ydb/docs/en/core/dev/system-views.md
user: login: azevaykin
body: A link to the owner in glossary
created_at: 2025-03-07T08:24:49Z
author_association: COLLABORATOR
diff_hunk: @@ -299,3 +300,109 @@ ORDER BY IntervalEnd desc, CPUCores desc
 ```
 
 * `"YYYY-MM-DDTHH:MM:SS.UUUUUUZ"`: Time in the UTC 0 zone (`YYYY` stands for year, `MM`, for month, `DD`, for date, `hh`, for hours, `mm`, for minutes, `ss`, for seconds, and `uuuuuu`, for microseconds). For example, `"2023-01-26T13:00:00.000000Z"`.
+
+## Access control entities {#auth}
+
+The following system views store data for analyzing various [access control entities](../security/authorization.md).
+
+### Auth users
+
+The `auth_users` view lists internal {{ ydb-short-name }} [users](../concepts/glossary.md#access-user). It does not include users authenticated through external systems such as LDAP.
+
+This view can be fully accessed by database administrators, while regular users can only view their own details.
+
+Table Structure:
+
+| Column | Description |
+|--------|-------------|
+| `Sid` | SID of the user.<br />Type: `Utf8`.<br />Key: `0`. |
+| `IsEnabled` | Indicates if login is allowed; used for explicit administrator block. Independent of `IsLockedOut`.<br />Type: `Bool`. |
+| `IsLockedOut` | Automatically locked out due to exceeding failed login attempts. Independent of `IsEnabled`.<br />Type: `Bool`. |
+| `CreatedAt` | Timestamp of user creation.<br />Type: `Timestamp`. |
+| `LastSuccessfulAttemptAt` | Timestamp of the last successful login attempt.<br />Type: `Timestamp`. |
+| `LastFailedAttemptAt` | Timestamp of the last failed login attempt.<br />Type: `Timestamp`. |
+| `FailedAttemptCount` | Number of failed login attempts.<br />Type: `Uint32`. |
+| `PasswordHash` | JSON string containing password hash, salt, and hash algorithm.<br />Type: `Utf8`. |
+
+### Auth groups
+
+The `auth_groups` view lists [access groups](../concepts/glossary.md#access-group).
+
+This view can be accessed only by database administrators.
+
+Table Structure:
+
+| Column | Description |
+|--------|-------------|
+| `Sid` | SID of the group.<br />Type: `Utf8`.<br />Key: `0`. |
+
+### Auth group members
+
+The `auth_group_members` view lists membership details within [access groups](../concepts/glossary.md#access-group).
+
+This view can be accessed only by database administrators.
+
+Table Structure:
+
+| Column | Description |
+|--------|-------------|
+| `GroupSid` | SID of the group.<br />Type: `Utf8`.<br />Key: `0`. |
+| `MemberSid` | SID of the group member.<br />Type: `Utf8`.<br />Key: `1`. |
+
+### Auth permissions
+
+The auth permissions views list assigned [access rights](../concepts/glossary.md#access-right).
+
+Contains two views:
+
+* `auth_permissions`: Directly assigned access rights.
+* `auth_effective_permissions`: Effective access rights, accounting for inheritance.
+
+A user can view an [access object](../concepts/glossary.md#access-object) in the results if they have the `ydb.granular.describe_schema` permission on it.
+
+Table Structure:
+
+| Column | Description |
+|--------|-------------|
+| `Path` | Path to the access object.<br />Type: `Utf8`.<br />Key: `0`. |
+| `Sid` | SID of the [access subject](../concepts/glossary.md#access-subject).<br />Type: `Utf8`.<br />Key: `1`. |
+| `Permission` | Name of the {{ ydb-short-name }} [access right](../yql/reference/syntax/grant.md#permissions-list).<br />Type: `Utf8`.<br />Key: `2`. |
+
+#### Example queries
+
+All the directly assigned permissions for the table located at the path `/Root/my_table`:
+
+```yql
+SELECT *
+    FROM `/Root/.sys/auth_permissions`
+    WHERE Path = "/Root/my_table"
+```
+
+All the effective permissions for the table located at the path `/Root/my_table`, including inherited permissions:
+
+```yql
+SELECT *
+    FROM `/Root/.sys/auth_effective_permissions`
+    WHERE Path = "/Root/my_table"
+```
+
+All permissions directly assigned to the user identified as `user3`:
+
+```yql
+SELECT *
+    FROM `/Root/.sys/auth_permissions`
+    WHERE Sid = "user3"
+```
+
+### Auth owners
+
+The `auth_owners` view lists details of [access objects](../concepts/glossary.md#access-object) ownership.
+
+A user can view an [access object](../concepts/glossary.md#access-object) in the results if they have the `ydb.granular.describe_schema` permission on it.
+
+Table Structure:
+
+| Column | Description |
+|--------|-------------|
+| `Path` | Path to the access object.<br />Type: `Utf8`.<br />Key: `0`. |
path: ydb/docs/en/core/dev/system-views.md
user: login: azevaykin
body: A link to the access object in glossary
created_at: 2025-03-07T08:25:31Z
author_association: COLLABORATOR
diff_hunk: @@ -299,3 +300,109 @@ ORDER BY IntervalEnd desc, CPUCores desc
 ```
 
 * `"YYYY-MM-DDTHH:MM:SS.UUUUUUZ"`: Time in the UTC 0 zone (`YYYY` stands for year, `MM`, for month, `DD`, for date, `hh`, for hours, `mm`, for minutes, `ss`, for seconds, and `uuuuuu`, for microseconds). For example, `"2023-01-26T13:00:00.000000Z"`.
+
+## Access control entities {#auth}
+
+The following system views store data for analyzing various [access control entities](../security/authorization.md).
+
+### Auth users
+
+The `auth_users` view lists internal {{ ydb-short-name }} [users](../concepts/glossary.md#access-user). It does not include users authenticated through external systems such as LDAP.
+
+This view can be fully accessed by database administrators, while regular users can only view their own details.
+
+Table Structure:
+
+| Column | Description |
+|--------|-------------|
+| `Sid` | SID of the user.<br />Type: `Utf8`.<br />Key: `0`. |
+| `IsEnabled` | Indicates if login is allowed; used for explicit administrator block. Independent of `IsLockedOut`.<br />Type: `Bool`. |
+| `IsLockedOut` | Automatically locked out due to exceeding failed login attempts. Independent of `IsEnabled`.<br />Type: `Bool`. |
+| `CreatedAt` | Timestamp of user creation.<br />Type: `Timestamp`. |
+| `LastSuccessfulAttemptAt` | Timestamp of the last successful login attempt.<br />Type: `Timestamp`. |
+| `LastFailedAttemptAt` | Timestamp of the last failed login attempt.<br />Type: `Timestamp`. |
+| `FailedAttemptCount` | Number of failed login attempts.<br />Type: `Uint32`. |
+| `PasswordHash` | JSON string containing password hash, salt, and hash algorithm.<br />Type: `Utf8`. |
+
+### Auth groups
+
+The `auth_groups` view lists [access groups](../concepts/glossary.md#access-group).
+
+This view can be accessed only by database administrators.
+
+Table Structure:
+
+| Column | Description |
+|--------|-------------|
+| `Sid` | SID of the group.<br />Type: `Utf8`.<br />Key: `0`. |
+
+### Auth group members
+
+The `auth_group_members` view lists membership details within [access groups](../concepts/glossary.md#access-group).
+
+This view can be accessed only by database administrators.
+
+Table Structure:
+
+| Column | Description |
+|--------|-------------|
+| `GroupSid` | SID of the group.<br />Type: `Utf8`.<br />Key: `0`. |
+| `MemberSid` | SID of the group member.<br />Type: `Utf8`.<br />Key: `1`. |
+
+### Auth permissions
+
+The auth permissions views list assigned [access rights](../concepts/glossary.md#access-right).
+
+Contains two views:
+
+* `auth_permissions`: Directly assigned access rights.
+* `auth_effective_permissions`: Effective access rights, accounting for inheritance.
+
+A user can view an [access object](../concepts/glossary.md#access-object) in the results if they have the `ydb.granular.describe_schema` permission on it.
+
+Table Structure:
+
+| Column | Description |
+|--------|-------------|
+| `Path` | Path to the access object.<br />Type: `Utf8`.<br />Key: `0`. |
path: ydb/docs/en/core/dev/system-views.md
user: login: azevaykin
body: A link to Access object in glossary
created_at: 2025-03-07T08:25:37Z
author_association: COLLABORATOR
diff_hunk: @@ -299,3 +300,109 @@ ORDER BY IntervalEnd desc, CPUCores desc
 ```
 
 * `"YYYY-MM-DDTHH:MM:SS.UUUUUUZ"`: Time in the UTC 0 zone (`YYYY` stands for year, `MM`, for month, `DD`, for date, `hh`, for hours, `mm`, for minutes, `ss`, for seconds, and `uuuuuu`, for microseconds). For example, `"2023-01-26T13:00:00.000000Z"`.
+
+## Access control entities {#auth}
+
+The following system views store data for analyzing various [access control entities](../security/authorization.md).
+
+### Auth users
+
+The `auth_users` view lists internal {{ ydb-short-name }} [users](../concepts/glossary.md#access-user). It does not include users authenticated through external systems such as LDAP.
+
+This view can be fully accessed by database administrators, while regular users can only view their own details.
+
+Table Structure:
+
+| Column | Description |
+|--------|-------------|
+| `Sid` | SID of the user.<br />Type: `Utf8`.<br />Key: `0`. |
+| `IsEnabled` | Indicates if login is allowed; used for explicit administrator block. Independent of `IsLockedOut`.<br />Type: `Bool`. |
+| `IsLockedOut` | Automatically locked out due to exceeding failed login attempts. Independent of `IsEnabled`.<br />Type: `Bool`. |
+| `CreatedAt` | Timestamp of user creation.<br />Type: `Timestamp`. |
+| `LastSuccessfulAttemptAt` | Timestamp of the last successful login attempt.<br />Type: `Timestamp`. |
+| `LastFailedAttemptAt` | Timestamp of the last failed login attempt.<br />Type: `Timestamp`. |
+| `FailedAttemptCount` | Number of failed login attempts.<br />Type: `Uint32`. |
+| `PasswordHash` | JSON string containing password hash, salt, and hash algorithm.<br />Type: `Utf8`. |
+
+### Auth groups
+
+The `auth_groups` view lists [access groups](../concepts/glossary.md#access-group).
+
+This view can be accessed only by database administrators.
+
+Table Structure:
+
+| Column | Description |
+|--------|-------------|
+| `Sid` | SID of the group.<br />Type: `Utf8`.<br />Key: `0`. |
+
+### Auth group members
+
+The `auth_group_members` view lists membership details within [access groups](../concepts/glossary.md#access-group).
+
+This view can be accessed only by database administrators.
+
+Table Structure:
+
+| Column | Description |
+|--------|-------------|
+| `GroupSid` | SID of the group.<br />Type: `Utf8`.<br />Key: `0`. |
+| `MemberSid` | SID of the group member.<br />Type: `Utf8`.<br />Key: `1`. |
+
+### Auth permissions
+
+The auth permissions views list assigned [access rights](../concepts/glossary.md#access-right).
+
+Contains two views:
+
+* `auth_permissions`: Directly assigned access rights.
+* `auth_effective_permissions`: Effective access rights, accounting for inheritance.
path: ydb/docs/en/core/dev/system-views.md
user: login: azevaykin
body: Could you add a short definition of 'inheritance' to the glossary and make a link here?
created_at: 2025-03-07T08:26:47Z
author_association: COLLABORATOR
diff_hunk: @@ -299,3 +300,109 @@ ORDER BY IntervalEnd desc, CPUCores desc
 ```
 
 * `"YYYY-MM-DDTHH:MM:SS.UUUUUUZ"`: Time in the UTC 0 zone (`YYYY` stands for year, `MM`, for month, `DD`, for date, `hh`, for hours, `mm`, for minutes, `ss`, for seconds, and `uuuuuu`, for microseconds). For example, `"2023-01-26T13:00:00.000000Z"`.
+
+## Access control entities {#auth}
+
+The following system views store data for analyzing various [access control entities](../security/authorization.md).
+
+### Auth users
+
+The `auth_users` view lists internal {{ ydb-short-name }} [users](../concepts/glossary.md#access-user). It does not include users authenticated through external systems such as LDAP.
+
+This view can be fully accessed by database administrators, while regular users can only view their own details.
+
+Table Structure:
+
+| Column | Description |
+|--------|-------------|
+| `Sid` | SID of the user.<br />Type: `Utf8`.<br />Key: `0`. |
+| `IsEnabled` | Indicates if login is allowed; used for explicit administrator block. Independent of `IsLockedOut`.<br />Type: `Bool`. |
+| `IsLockedOut` | Automatically locked out due to exceeding failed login attempts. Independent of `IsEnabled`.<br />Type: `Bool`. |
+| `CreatedAt` | Timestamp of user creation.<br />Type: `Timestamp`. |
+| `LastSuccessfulAttemptAt` | Timestamp of the last successful login attempt.<br />Type: `Timestamp`. |
+| `LastFailedAttemptAt` | Timestamp of the last failed login attempt.<br />Type: `Timestamp`. |
+| `FailedAttemptCount` | Number of failed login attempts.<br />Type: `Uint32`. |
+| `PasswordHash` | JSON string containing password hash, salt, and hash algorithm.<br />Type: `Utf8`. |
+
+### Auth groups
+
+The `auth_groups` view lists [access groups](../concepts/glossary.md#access-group).
+
+This view can be accessed only by database administrators.
+
+Table Structure:
+
+| Column | Description |
+|--------|-------------|
+| `Sid` | SID of the group.<br />Type: `Utf8`.<br />Key: `0`. |
+
+### Auth group members
+
+The `auth_group_members` view lists membership details within [access groups](../concepts/glossary.md#access-group).
+
+This view can be accessed only by database administrators.
+
+Table Structure:
+
+| Column | Description |
+|--------|-------------|
+| `GroupSid` | SID of the group.<br />Type: `Utf8`.<br />Key: `0`. |
+| `MemberSid` | SID of the group member.<br />Type: `Utf8`.<br />Key: `1`. |
+
+### Auth permissions
+
+The auth permissions views list assigned [access rights](../concepts/glossary.md#access-right).
+
+Contains two views:
+
+* `auth_permissions`: Directly assigned access rights.
+* `auth_effective_permissions`: Effective access rights, accounting for inheritance.
+
+A user can view an [access object](../concepts/glossary.md#access-object) in the results if they have the `ydb.granular.describe_schema` permission on it.
+
+Table Structure:
+
+| Column | Description |
+|--------|-------------|
+| `Path` | Path to the access object.<br />Type: `Utf8`.<br />Key: `0`. |
path: ydb/docs/en/core/dev/system-views.md
user: login: kungasc
body: As far as I know, we usually put a link to a glossary item only on the first mention of it.

So here we already have it one line above.
created_at: 2025-03-07T08:33:31Z
author_association: CONTRIBUTOR
diff_hunk: @@ -299,3 +300,109 @@ ORDER BY IntervalEnd desc, CPUCores desc
 ```
 
 * `"YYYY-MM-DDTHH:MM:SS.UUUUUUZ"`: Time in the UTC 0 zone (`YYYY` stands for year, `MM`, for month, `DD`, for date, `hh`, for hours, `mm`, for minutes, `ss`, for seconds, and `uuuuuu`, for microseconds). For example, `"2023-01-26T13:00:00.000000Z"`.
+
+## Access control entities {#auth}
+
+The following system views store data for analyzing various [access control entities](../security/authorization.md).
+
+### Auth users
+
+The `auth_users` view lists internal {{ ydb-short-name }} [users](../concepts/glossary.md#access-user). It does not include users authenticated through external systems such as LDAP.
+
+This view can be fully accessed by database administrators, while regular users can only view their own details.
+
+Table Structure:
+
+| Column | Description |
+|--------|-------------|
+| `Sid` | SID of the user.<br />Type: `Utf8`.<br />Key: `0`. |
+| `IsEnabled` | Indicates if login is allowed; used for explicit administrator block. Independent of `IsLockedOut`.<br />Type: `Bool`. |
+| `IsLockedOut` | Automatically locked out due to exceeding failed login attempts. Independent of `IsEnabled`.<br />Type: `Bool`. |
+| `CreatedAt` | Timestamp of user creation.<br />Type: `Timestamp`. |
+| `LastSuccessfulAttemptAt` | Timestamp of the last successful login attempt.<br />Type: `Timestamp`. |
+| `LastFailedAttemptAt` | Timestamp of the last failed login attempt.<br />Type: `Timestamp`. |
+| `FailedAttemptCount` | Number of failed login attempts.<br />Type: `Uint32`. |
+| `PasswordHash` | JSON string containing password hash, salt, and hash algorithm.<br />Type: `Utf8`. |
+
+### Auth groups
+
+The `auth_groups` view lists [access groups](../concepts/glossary.md#access-group).
+
+This view can be accessed only by database administrators.
+
+Table Structure:
+
+| Column | Description |
+|--------|-------------|
+| `Sid` | SID of the group.<br />Type: `Utf8`.<br />Key: `0`. |
+
+### Auth group members
+
+The `auth_group_members` view lists membership details within [access groups](../concepts/glossary.md#access-group).
+
+This view can be accessed only by database administrators.
+
+Table Structure:
+
+| Column | Description |
+|--------|-------------|
+| `GroupSid` | SID of the group.<br />Type: `Utf8`.<br />Key: `0`. |
+| `MemberSid` | SID of the group member.<br />Type: `Utf8`.<br />Key: `1`. |
+
+### Auth permissions
+
+The auth permissions views list assigned [access rights](../concepts/glossary.md#access-right).
+
+Contains two views:
+
+* `auth_permissions`: Directly assigned access rights.
+* `auth_effective_permissions`: Effective access rights, accounting for inheritance.
+
+A user can view an [access object](../concepts/glossary.md#access-object) in the results if they have the `ydb.granular.describe_schema` permission on it.
+
+Table Structure:
+
+| Column | Description |
+|--------|-------------|
+| `Path` | Path to the access object.<br />Type: `Utf8`.<br />Key: `0`. |
+| `Sid` | SID of the [access subject](../concepts/glossary.md#access-subject).<br />Type: `Utf8`.<br />Key: `1`. |
+| `Permission` | Name of the {{ ydb-short-name }} [access right](../yql/reference/syntax/grant.md#permissions-list).<br />Type: `Utf8`.<br />Key: `2`. |
+
+#### Example queries
+
+All the directly assigned permissions for the table located at the path `/Root/my_table`:
+
+```yql
+SELECT *
+    FROM `/Root/.sys/auth_permissions`
+    WHERE Path = "/Root/my_table"
+```
+
+All the effective permissions for the table located at the path `/Root/my_table`, including inherited permissions:
+
+```yql
+SELECT *
+    FROM `/Root/.sys/auth_effective_permissions`
+    WHERE Path = "/Root/my_table"
+```
+
+All permissions directly assigned to the user identified as `user3`:
+
+```yql
+SELECT *
+    FROM `/Root/.sys/auth_permissions`
+    WHERE Sid = "user3"
+```
+
+### Auth owners
+
+The `auth_owners` view lists details of [access objects](../concepts/glossary.md#access-object) ownership.
+
+A user can view an [access object](../concepts/glossary.md#access-object) in the results if they have the `ydb.granular.describe_schema` permission on it.
+
+Table Structure:
+
+| Column | Description |
+|--------|-------------|
+| `Path` | Path to the access object.<br />Type: `Utf8`.<br />Key: `0`. |
path: ydb/docs/en/core/dev/system-views.md
user: login: kungasc
body: same
created_at: 2025-03-07T08:35:10Z
author_association: CONTRIBUTOR
diff_hunk: @@ -299,3 +300,109 @@ ORDER BY IntervalEnd desc, CPUCores desc
 ```
 
 * `"YYYY-MM-DDTHH:MM:SS.UUUUUUZ"`: Time in the UTC 0 zone (`YYYY` stands for year, `MM`, for month, `DD`, for date, `hh`, for hours, `mm`, for minutes, `ss`, for seconds, and `uuuuuu`, for microseconds). For example, `"2023-01-26T13:00:00.000000Z"`.
+
+## Access control entities {#auth}
+
+The following system views store data for analyzing various [access control entities](../security/authorization.md).
+
+### Auth users
+
+The `auth_users` view lists internal {{ ydb-short-name }} [users](../concepts/glossary.md#access-user). It does not include users authenticated through external systems such as LDAP.
+
+This view can be fully accessed by database administrators, while regular users can only view their own details.
+
+Table Structure:
+
+| Column | Description |
+|--------|-------------|
+| `Sid` | SID of the user.<br />Type: `Utf8`.<br />Key: `0`. |
+| `IsEnabled` | Indicates if login is allowed; used for explicit administrator block. Independent of `IsLockedOut`.<br />Type: `Bool`. |
+| `IsLockedOut` | Automatically locked out due to exceeding failed login attempts. Independent of `IsEnabled`.<br />Type: `Bool`. |
+| `CreatedAt` | Timestamp of user creation.<br />Type: `Timestamp`. |
+| `LastSuccessfulAttemptAt` | Timestamp of the last successful login attempt.<br />Type: `Timestamp`. |
+| `LastFailedAttemptAt` | Timestamp of the last failed login attempt.<br />Type: `Timestamp`. |
+| `FailedAttemptCount` | Number of failed login attempts.<br />Type: `Uint32`. |
+| `PasswordHash` | JSON string containing password hash, salt, and hash algorithm.<br />Type: `Utf8`. |
+
+### Auth groups
+
+The `auth_groups` view lists [access groups](../concepts/glossary.md#access-group).
+
+This view can be accessed only by database administrators.
+
+Table Structure:
+
+| Column | Description |
+|--------|-------------|
+| `Sid` | SID of the group.<br />Type: `Utf8`.<br />Key: `0`. |
+
+### Auth group members
+
+The `auth_group_members` view lists membership details within [access groups](../concepts/glossary.md#access-group).
+
+This view can be accessed only by database administrators.
+
+Table Structure:
+
+| Column | Description |
+|--------|-------------|
+| `GroupSid` | SID of the group.<br />Type: `Utf8`.<br />Key: `0`. |
+| `MemberSid` | SID of the group member.<br />Type: `Utf8`.<br />Key: `1`. |
+
+### Auth permissions
+
+The auth permissions views list assigned [access rights](../concepts/glossary.md#access-right).
+
+Contains two views:
+
+* `auth_permissions`: Directly assigned access rights.
+* `auth_effective_permissions`: Effective access rights, accounting for inheritance.
+
+A user can view an [access object](../concepts/glossary.md#access-object) in the results if they have the `ydb.granular.describe_schema` permission on it.
+
+Table Structure:
+
+| Column | Description |
+|--------|-------------|
+| `Path` | Path to the access object.<br />Type: `Utf8`.<br />Key: `0`. |
+| `Sid` | SID of the [access subject](../concepts/glossary.md#access-subject).<br />Type: `Utf8`.<br />Key: `1`. |
+| `Permission` | Name of the {{ ydb-short-name }} [access right](../yql/reference/syntax/grant.md#permissions-list).<br />Type: `Utf8`.<br />Key: `2`. |
+
+#### Example queries
+
+All the directly assigned permissions for the table located at the path `/Root/my_table`:
+
+```yql
+SELECT *
+    FROM `/Root/.sys/auth_permissions`
+    WHERE Path = "/Root/my_table"
+```
+
+All the effective permissions for the table located at the path `/Root/my_table`, including inherited permissions:
+
+```yql
+SELECT *
+    FROM `/Root/.sys/auth_effective_permissions`
+    WHERE Path = "/Root/my_table"
+```
+
+All permissions directly assigned to the user identified as `user3`:
+
+```yql
+SELECT *
+    FROM `/Root/.sys/auth_permissions`
+    WHERE Sid = "user3"
+```
+
+### Auth owners
+
+The `auth_owners` view lists details of [access objects](../concepts/glossary.md#access-object) ownership.
+
+A user can view an [access object](../concepts/glossary.md#access-object) in the results if they have the `ydb.granular.describe_schema` permission on it.
+
+Table Structure:
+
+| Column | Description |
+|--------|-------------|
+| `Path` | Path to the access object.<br />Type: `Utf8`.<br />Key: `0`. |
+| `Sid` | SID of the access object owner.<br />Type: `Utf8`. |
path: ydb/docs/en/core/dev/system-views.md
user: login: kungasc
body: same
created_at: 2025-03-07T08:35:17Z
author_association: CONTRIBUTOR
diff_hunk: @@ -278,23 +278,27 @@ An access subject can be a [user](#access-user) or a [group](#access-group).
 
 ### Access right {#access-right}
 
-An **[access right](../security/authorization.md#right)** is an entity that represents permission for an [access subject](#access-subject) to perform a specific set of operations in a cluster or database on a specific [access object](#access-object).
+An **access right** is an entity that represents permission for an [access subject](#access-subject) to perform a specific set of operations in a cluster or database on a specific [access object](#access-object).
+
+### Access right inheritance {#access-right-inheritance}
+
+**Access right inheritance** refers to the mechanism by which [access rights](#access-right) are automatically passed down from parent [access objects](#access-object) to child access objects within a database structure. This ensures that permissions granted at a higher level in the hierarchy are applied to all sub-levels beneath it, unless [explicitly overridden](../reference/ydb-cli/commands/scheme-permissions.md#clear-inheritance).
 
 ### Access control list {#access-control-list}
 
 An **access control list** or **ACL** is a list of all [rights](#access-right) granted to [access subjects](#access-subject) (users and groups) for a specific [access object](#access-object).
 
 ### Owner {#access-owner}
 
-An **[owner](../security/authorization.md#owner)** is an [access subject](#access-subject) ([user](#access-user) or [group](#access-group)) having full rights over a specific [access object](#access-object).
+An **owner** is an [access subject](#access-subject) ([user](#access-user) or [group](#access-group)) having full rights over a specific [access object](#access-object).
path: ydb/docs/en/core/concepts/glossary.md
user: login: blinkov
body: Why do you drop these links, and how are they related to sysviews?
created_at: 2025-03-10T05:52:43Z
author_association: CONTRIBUTOR
diff_hunk: @@ -299,3 +300,109 @@ ORDER BY IntervalEnd desc, CPUCores desc
 ```
 
 * `"YYYY-MM-DDTHH:MM:SS.UUUUUUZ"`: Time in the UTC 0 zone (`YYYY` stands for year, `MM`, for month, `DD`, for date, `hh`, for hours, `mm`, for minutes, `ss`, for seconds, and `uuuuuu`, for microseconds). For example, `"2023-01-26T13:00:00.000000Z"`.
+
+## Access control entities {#auth}
+
+The following system views store data for analyzing various [access control entities](../security/authorization.md).
+
+### Auth users
+
+The `auth_users` view lists internal {{ ydb-short-name }} [users](../concepts/glossary.md#access-user). It does not include users authenticated through external systems such as LDAP.
+
+This view can be fully accessed by database administrators, while regular users can only view their own details.
path: ydb/docs/en/core/dev/system-views.md
user: login: blinkov
body: What exactly permissions are needed to access the whole table? The term "database administrators" refers to membership in the `DATABASE-ADMINS` group from https://ydb.tech/docs/ru/security/builtin-security#gruppy or something else?
created_at: 2025-03-10T05:58:23Z
author_association: CONTRIBUTOR
diff_hunk: @@ -299,3 +300,109 @@ ORDER BY IntervalEnd desc, CPUCores desc
 ```
 
 * `"YYYY-MM-DDTHH:MM:SS.UUUUUUZ"`: Time in the UTC 0 zone (`YYYY` stands for year, `MM`, for month, `DD`, for date, `hh`, for hours, `mm`, for minutes, `ss`, for seconds, and `uuuuuu`, for microseconds). For example, `"2023-01-26T13:00:00.000000Z"`.
+
+## Access control entities {#auth}
+
+The following system views store data for analyzing various [access control entities](../security/authorization.md).
+
+### Auth users
+
+The `auth_users` view lists internal {{ ydb-short-name }} [users](../concepts/glossary.md#access-user). It does not include users authenticated through external systems such as LDAP.
+
+This view can be fully accessed by database administrators, while regular users can only view their own details.
+
+Table Structure:
path: ydb/docs/en/core/dev/system-views.md
user: login: blinkov
body: ```suggestion
Table structure:
```
...and similarly below
created_at: 2025-03-10T06:00:06Z
author_association: CONTRIBUTOR
diff_hunk: @@ -299,3 +300,109 @@ ORDER BY IntervalEnd desc, CPUCores desc
 ```
 
 * `"YYYY-MM-DDTHH:MM:SS.UUUUUUZ"`: Time in the UTC 0 zone (`YYYY` stands for year, `MM`, for month, `DD`, for date, `hh`, for hours, `mm`, for minutes, `ss`, for seconds, and `uuuuuu`, for microseconds). For example, `"2023-01-26T13:00:00.000000Z"`.
+
+## Access control entities {#auth}
+
+The following system views store data for analyzing various [access control entities](../security/authorization.md).
+
+### Auth users
+
+The `auth_users` view lists internal {{ ydb-short-name }} [users](../concepts/glossary.md#access-user). It does not include users authenticated through external systems such as LDAP.
+
+This view can be fully accessed by database administrators, while regular users can only view their own details.
+
+Table Structure:
+
+| Column | Description |
+|--------|-------------|
+| `Sid` | SID of the user.<br />Type: `Utf8`.<br />Key: `0`. |
path: ydb/docs/en/core/dev/system-views.md
user: login: blinkov
body: ```suggestion
| `Sid` | [SID](../concepts/glossary.md#sid) of the user.<br />Type: `Utf8`.<br />Key: `0`. |
```
created_at: 2025-03-10T06:01:56Z
author_association: CONTRIBUTOR
diff_hunk: @@ -299,3 +300,109 @@ ORDER BY IntervalEnd desc, CPUCores desc
 ```
 
 * `"YYYY-MM-DDTHH:MM:SS.UUUUUUZ"`: Time in the UTC 0 zone (`YYYY` stands for year, `MM`, for month, `DD`, for date, `hh`, for hours, `mm`, for minutes, `ss`, for seconds, and `uuuuuu`, for microseconds). For example, `"2023-01-26T13:00:00.000000Z"`.
+
+## Access control entities {#auth}
+
+The following system views store data for analyzing various [access control entities](../security/authorization.md).
+
+### Auth users
+
+The `auth_users` view lists internal {{ ydb-short-name }} [users](../concepts/glossary.md#access-user). It does not include users authenticated through external systems such as LDAP.
+
+This view can be fully accessed by database administrators, while regular users can only view their own details.
+
+Table Structure:
+
+| Column | Description |
+|--------|-------------|
+| `Sid` | SID of the user.<br />Type: `Utf8`.<br />Key: `0`. |
+| `IsEnabled` | Indicates if login is allowed; used for explicit administrator block. Independent of `IsLockedOut`.<br />Type: `Bool`. |
+| `IsLockedOut` | Automatically locked out due to exceeding failed login attempts. Independent of `IsEnabled`.<br />Type: `Bool`. |
+| `CreatedAt` | Timestamp of user creation.<br />Type: `Timestamp`. |
+| `LastSuccessfulAttemptAt` | Timestamp of the last successful login attempt.<br />Type: `Timestamp`. |
+| `LastFailedAttemptAt` | Timestamp of the last failed login attempt.<br />Type: `Timestamp`. |
+| `FailedAttemptCount` | Number of failed login attempts.<br />Type: `Uint32`. |
+| `PasswordHash` | JSON string containing password hash, salt, and hash algorithm.<br />Type: `Utf8`. |
path: ydb/docs/en/core/dev/system-views.md
user: login: blinkov
body: Why is it Utf8 instead of JsonDocument or Json?
created_at: 2025-03-10T06:02:10Z
author_association: CONTRIBUTOR
diff_hunk: @@ -299,3 +300,109 @@ ORDER BY IntervalEnd desc, CPUCores desc
 ```
 
 * `"YYYY-MM-DDTHH:MM:SS.UUUUUUZ"`: Time in the UTC 0 zone (`YYYY` stands for year, `MM`, for month, `DD`, for date, `hh`, for hours, `mm`, for minutes, `ss`, for seconds, and `uuuuuu`, for microseconds). For example, `"2023-01-26T13:00:00.000000Z"`.
+
+## Access control entities {#auth}
+
+The following system views store data for analyzing various [access control entities](../security/authorization.md).
+
+### Auth users
+
+The `auth_users` view lists internal {{ ydb-short-name }} [users](../concepts/glossary.md#access-user). It does not include users authenticated through external systems such as LDAP.
+
+This view can be fully accessed by database administrators, while regular users can only view their own details.
+
+Table Structure:
+
+| Column | Description |
+|--------|-------------|
+| `Sid` | SID of the user.<br />Type: `Utf8`.<br />Key: `0`. |
+| `IsEnabled` | Indicates if login is allowed; used for explicit administrator block. Independent of `IsLockedOut`.<br />Type: `Bool`. |
+| `IsLockedOut` | Automatically locked out due to exceeding failed login attempts. Independent of `IsEnabled`.<br />Type: `Bool`. |
+| `CreatedAt` | Timestamp of user creation.<br />Type: `Timestamp`. |
+| `LastSuccessfulAttemptAt` | Timestamp of the last successful login attempt.<br />Type: `Timestamp`. |
+| `LastFailedAttemptAt` | Timestamp of the last failed login attempt.<br />Type: `Timestamp`. |
+| `FailedAttemptCount` | Number of failed login attempts.<br />Type: `Uint32`. |
+| `PasswordHash` | JSON string containing password hash, salt, and hash algorithm.<br />Type: `Utf8`. |
+
+### Auth groups
+
+The `auth_groups` view lists [access groups](../concepts/glossary.md#access-group).
+
+This view can be accessed only by database administrators.
+
+Table Structure:
+
+| Column | Description |
+|--------|-------------|
+| `Sid` | SID of the group.<br />Type: `Utf8`.<br />Key: `0`. |
+
+### Auth group members
+
+The `auth_group_members` view lists membership details within [access groups](../concepts/glossary.md#access-group).
+
+This view can be accessed only by database administrators.
+
+Table Structure:
+
+| Column | Description |
+|--------|-------------|
+| `GroupSid` | SID of the group.<br />Type: `Utf8`.<br />Key: `0`. |
+| `MemberSid` | SID of the group member.<br />Type: `Utf8`.<br />Key: `1`. |
+
+### Auth permissions
+
+The auth permissions views list assigned [access rights](../concepts/glossary.md#access-right).
+
+Contains two views:
+
+* `auth_permissions`: Directly assigned access rights.
+* `auth_effective_permissions`: Effective access rights, accounting for [inheritance](../concepts/glossary.md#access-right-inheritance).
+
+A user can view an [access object](../concepts/glossary.md#access-object) in the results if they have the `ydb.granular.describe_schema` permission on it.
+
+Table Structure:
+
+| Column | Description |
+|--------|-------------|
+| `Path` | Path to the access object.<br />Type: `Utf8`.<br />Key: `0`. |
+| `Sid` | SID of the [access subject](../concepts/glossary.md#access-subject).<br />Type: `Utf8`.<br />Key: `1`. |
+| `Permission` | Name of the {{ ydb-short-name }} [access right](../yql/reference/syntax/grant.md#permissions-list).<br />Type: `Utf8`.<br />Key: `2`. |
+
+#### Example queries
+
+All the directly assigned permissions for the table located at the path `/Root/my_table`:
+
+```yql
+SELECT *
+    FROM `/Root/.sys/auth_permissions`
+    WHERE Path = "/Root/my_table"
path: ydb/docs/en/core/dev/system-views.md
user: login: blinkov
body: ```suggestion
FROM `/Root/.sys/auth_permissions`
WHERE Path = "/Root/my_table"
```
created_at: 2025-03-10T06:07:40Z
author_association: CONTRIBUTOR
diff_hunk: @@ -299,3 +300,109 @@ ORDER BY IntervalEnd desc, CPUCores desc
 ```
 
 * `"YYYY-MM-DDTHH:MM:SS.UUUUUUZ"`: Time in the UTC 0 zone (`YYYY` stands for year, `MM`, for month, `DD`, for date, `hh`, for hours, `mm`, for minutes, `ss`, for seconds, and `uuuuuu`, for microseconds). For example, `"2023-01-26T13:00:00.000000Z"`.
+
+## Access control entities {#auth}
+
+The following system views store data for analyzing various [access control entities](../security/authorization.md).
+
+### Auth users
+
+The `auth_users` view lists internal {{ ydb-short-name }} [users](../concepts/glossary.md#access-user). It does not include users authenticated through external systems such as LDAP.
+
+This view can be fully accessed by database administrators, while regular users can only view their own details.
+
+Table Structure:
+
+| Column | Description |
+|--------|-------------|
+| `Sid` | SID of the user.<br />Type: `Utf8`.<br />Key: `0`. |
+| `IsEnabled` | Indicates if login is allowed; used for explicit administrator block. Independent of `IsLockedOut`.<br />Type: `Bool`. |
+| `IsLockedOut` | Automatically locked out due to exceeding failed login attempts. Independent of `IsEnabled`.<br />Type: `Bool`. |
+| `CreatedAt` | Timestamp of user creation.<br />Type: `Timestamp`. |
+| `LastSuccessfulAttemptAt` | Timestamp of the last successful login attempt.<br />Type: `Timestamp`. |
+| `LastFailedAttemptAt` | Timestamp of the last failed login attempt.<br />Type: `Timestamp`. |
+| `FailedAttemptCount` | Number of failed login attempts.<br />Type: `Uint32`. |
+| `PasswordHash` | JSON string containing password hash, salt, and hash algorithm.<br />Type: `Utf8`. |
+
+### Auth groups
+
+The `auth_groups` view lists [access groups](../concepts/glossary.md#access-group).
+
+This view can be accessed only by database administrators.
+
+Table Structure:
+
+| Column | Description |
+|--------|-------------|
+| `Sid` | SID of the group.<br />Type: `Utf8`.<br />Key: `0`. |
+
+### Auth group members
+
+The `auth_group_members` view lists membership details within [access groups](../concepts/glossary.md#access-group).
+
+This view can be accessed only by database administrators.
+
+Table Structure:
+
+| Column | Description |
+|--------|-------------|
+| `GroupSid` | SID of the group.<br />Type: `Utf8`.<br />Key: `0`. |
+| `MemberSid` | SID of the group member.<br />Type: `Utf8`.<br />Key: `1`. |
+
+### Auth permissions
+
+The auth permissions views list assigned [access rights](../concepts/glossary.md#access-right).
+
+Contains two views:
+
+* `auth_permissions`: Directly assigned access rights.
+* `auth_effective_permissions`: Effective access rights, accounting for [inheritance](../concepts/glossary.md#access-right-inheritance).
+
+A user can view an [access object](../concepts/glossary.md#access-object) in the results if they have the `ydb.granular.describe_schema` permission on it.
+
+Table Structure:
+
+| Column | Description |
+|--------|-------------|
+| `Path` | Path to the access object.<br />Type: `Utf8`.<br />Key: `0`. |
+| `Sid` | SID of the [access subject](../concepts/glossary.md#access-subject).<br />Type: `Utf8`.<br />Key: `1`. |
+| `Permission` | Name of the {{ ydb-short-name }} [access right](../yql/reference/syntax/grant.md#permissions-list).<br />Type: `Utf8`.<br />Key: `2`. |
+
+#### Example queries
+
+All the directly assigned permissions for the table located at the path `/Root/my_table`:
+
+```yql
+SELECT *
+    FROM `/Root/.sys/auth_permissions`
+    WHERE Path = "/Root/my_table"
+```
+
+All the effective permissions for the table located at the path `/Root/my_table`, including inherited permissions:
+
+```yql
+SELECT *
+    FROM `/Root/.sys/auth_effective_permissions`
+    WHERE Path = "/Root/my_table"
path: ydb/docs/en/core/dev/system-views.md
user: login: blinkov
body: ```suggestion
FROM `/Root/.sys/auth_effective_permissions`
WHERE Path = "/Root/my_table"
```
created_at: 2025-03-10T06:07:50Z
author_association: CONTRIBUTOR
diff_hunk: @@ -299,3 +300,109 @@ ORDER BY IntervalEnd desc, CPUCores desc
 ```
 
 * `"YYYY-MM-DDTHH:MM:SS.UUUUUUZ"`: Time in the UTC 0 zone (`YYYY` stands for year, `MM`, for month, `DD`, for date, `hh`, for hours, `mm`, for minutes, `ss`, for seconds, and `uuuuuu`, for microseconds). For example, `"2023-01-26T13:00:00.000000Z"`.
+
+## Access control entities {#auth}
+
+The following system views store data for analyzing various [access control entities](../security/authorization.md).
+
+### Auth users
+
+The `auth_users` view lists internal {{ ydb-short-name }} [users](../concepts/glossary.md#access-user). It does not include users authenticated through external systems such as LDAP.
+
+This view can be fully accessed by database administrators, while regular users can only view their own details.
+
+Table Structure:
+
+| Column | Description |
+|--------|-------------|
+| `Sid` | SID of the user.<br />Type: `Utf8`.<br />Key: `0`. |
+| `IsEnabled` | Indicates if login is allowed; used for explicit administrator block. Independent of `IsLockedOut`.<br />Type: `Bool`. |
+| `IsLockedOut` | Automatically locked out due to exceeding failed login attempts. Independent of `IsEnabled`.<br />Type: `Bool`. |
+| `CreatedAt` | Timestamp of user creation.<br />Type: `Timestamp`. |
+| `LastSuccessfulAttemptAt` | Timestamp of the last successful login attempt.<br />Type: `Timestamp`. |
+| `LastFailedAttemptAt` | Timestamp of the last failed login attempt.<br />Type: `Timestamp`. |
+| `FailedAttemptCount` | Number of failed login attempts.<br />Type: `Uint32`. |
+| `PasswordHash` | JSON string containing password hash, salt, and hash algorithm.<br />Type: `Utf8`. |
+
+### Auth groups
+
+The `auth_groups` view lists [access groups](../concepts/glossary.md#access-group).
+
+This view can be accessed only by database administrators.
+
+Table Structure:
+
+| Column | Description |
+|--------|-------------|
+| `Sid` | SID of the group.<br />Type: `Utf8`.<br />Key: `0`. |
+
+### Auth group members
+
+The `auth_group_members` view lists membership details within [access groups](../concepts/glossary.md#access-group).
+
+This view can be accessed only by database administrators.
+
+Table Structure:
+
+| Column | Description |
+|--------|-------------|
+| `GroupSid` | SID of the group.<br />Type: `Utf8`.<br />Key: `0`. |
+| `MemberSid` | SID of the group member.<br />Type: `Utf8`.<br />Key: `1`. |
+
+### Auth permissions
+
+The auth permissions views list assigned [access rights](../concepts/glossary.md#access-right).
+
+Contains two views:
+
+* `auth_permissions`: Directly assigned access rights.
+* `auth_effective_permissions`: Effective access rights, accounting for [inheritance](../concepts/glossary.md#access-right-inheritance).
+
+A user can view an [access object](../concepts/glossary.md#access-object) in the results if they have the `ydb.granular.describe_schema` permission on it.
+
+Table Structure:
+
+| Column | Description |
+|--------|-------------|
+| `Path` | Path to the access object.<br />Type: `Utf8`.<br />Key: `0`. |
+| `Sid` | SID of the [access subject](../concepts/glossary.md#access-subject).<br />Type: `Utf8`.<br />Key: `1`. |
+| `Permission` | Name of the {{ ydb-short-name }} [access right](../yql/reference/syntax/grant.md#permissions-list).<br />Type: `Utf8`.<br />Key: `2`. |
+
+#### Example queries
+
+All the directly assigned permissions for the table located at the path `/Root/my_table`:
+
+```yql
+SELECT *
+    FROM `/Root/.sys/auth_permissions`
+    WHERE Path = "/Root/my_table"
+```
+
+All the effective permissions for the table located at the path `/Root/my_table`, including inherited permissions:
+
+```yql
+SELECT *
+    FROM `/Root/.sys/auth_effective_permissions`
+    WHERE Path = "/Root/my_table"
+```
+
+All permissions directly assigned to the user identified as `user3`:
+
+```yql
+SELECT *
+    FROM `/Root/.sys/auth_permissions`
+    WHERE Sid = "user3"
path: ydb/docs/en/core/dev/system-views.md
user: login: blinkov
body: ```suggestion
FROM `/Root/.sys/auth_permissions`
WHERE Sid = "user3"
```
created_at: 2025-03-10T06:08:28Z
author_association: CONTRIBUTOR
diff_hunk: @@ -299,3 +300,109 @@ ORDER BY IntervalEnd desc, CPUCores desc
 ```
 
 * `"YYYY-MM-DDTHH:MM:SS.UUUUUUZ"`: Time in the UTC 0 zone (`YYYY` stands for year, `MM`, for month, `DD`, for date, `hh`, for hours, `mm`, for minutes, `ss`, for seconds, and `uuuuuu`, for microseconds). For example, `"2023-01-26T13:00:00.000000Z"`.
+
+## Access control entities {#auth}
+
+The following system views store data for analyzing various [access control entities](../security/authorization.md).
+
+### Auth users
+
+The `auth_users` view lists internal {{ ydb-short-name }} [users](../concepts/glossary.md#access-user). It does not include users authenticated through external systems such as LDAP.
+
+This view can be fully accessed by database administrators, while regular users can only view their own details.
+
+Table Structure:
+
+| Column | Description |
+|--------|-------------|
+| `Sid` | SID of the user.<br />Type: `Utf8`.<br />Key: `0`. |
+| `IsEnabled` | Indicates if login is allowed; used for explicit administrator block. Independent of `IsLockedOut`.<br />Type: `Bool`. |
+| `IsLockedOut` | Automatically locked out due to exceeding failed login attempts. Independent of `IsEnabled`.<br />Type: `Bool`. |
+| `CreatedAt` | Timestamp of user creation.<br />Type: `Timestamp`. |
+| `LastSuccessfulAttemptAt` | Timestamp of the last successful login attempt.<br />Type: `Timestamp`. |
+| `LastFailedAttemptAt` | Timestamp of the last failed login attempt.<br />Type: `Timestamp`. |
+| `FailedAttemptCount` | Number of failed login attempts.<br />Type: `Uint32`. |
+| `PasswordHash` | JSON string containing password hash, salt, and hash algorithm.<br />Type: `Utf8`. |
+
+### Auth groups
+
+The `auth_groups` view lists [access groups](../concepts/glossary.md#access-group).
+
+This view can be accessed only by database administrators.
+
+Table Structure:
+
+| Column | Description |
+|--------|-------------|
+| `Sid` | SID of the group.<br />Type: `Utf8`.<br />Key: `0`. |
+
+### Auth group members
+
+The `auth_group_members` view lists membership details within [access groups](../concepts/glossary.md#access-group).
+
+This view can be accessed only by database administrators.
+
+Table Structure:
+
+| Column | Description |
+|--------|-------------|
+| `GroupSid` | SID of the group.<br />Type: `Utf8`.<br />Key: `0`. |
+| `MemberSid` | SID of the group member.<br />Type: `Utf8`.<br />Key: `1`. |
+
+### Auth permissions
+
+The auth permissions views list assigned [access rights](../concepts/glossary.md#access-right).
+
+Contains two views:
+
+* `auth_permissions`: Directly assigned access rights.
+* `auth_effective_permissions`: Effective access rights, accounting for [inheritance](../concepts/glossary.md#access-right-inheritance).
+
+A user can view an [access object](../concepts/glossary.md#access-object) in the results if they have the `ydb.granular.describe_schema` permission on it.
+
+Table Structure:
+
+| Column | Description |
+|--------|-------------|
+| `Path` | Path to the access object.<br />Type: `Utf8`.<br />Key: `0`. |
+| `Sid` | SID of the [access subject](../concepts/glossary.md#access-subject).<br />Type: `Utf8`.<br />Key: `1`. |
+| `Permission` | Name of the {{ ydb-short-name }} [access right](../yql/reference/syntax/grant.md#permissions-list).<br />Type: `Utf8`.<br />Key: `2`. |
+
+#### Example queries
+
+All the directly assigned permissions for the table located at the path `/Root/my_table`:
+
+```yql
+SELECT *
+    FROM `/Root/.sys/auth_permissions`
path: ydb/docs/en/core/dev/system-views.md
user: login: blinkov
body: Isn't `/Root/` excessive in these examples? IIRC, such queries were working even without it.
created_at: 2025-03-10T06:17:55Z
author_association: CONTRIBUTOR
diff_hunk: @@ -299,3 +300,109 @@ ORDER BY IntervalEnd desc, CPUCores desc
 ```
 
 * `"YYYY-MM-DDTHH:MM:SS.UUUUUUZ"`: Time in the UTC 0 zone (`YYYY` stands for year, `MM`, for month, `DD`, for date, `hh`, for hours, `mm`, for minutes, `ss`, for seconds, and `uuuuuu`, for microseconds). For example, `"2023-01-26T13:00:00.000000Z"`.
+
+## Access control entities {#auth}
+
+The following system views store data for analyzing various [access control entities](../security/authorization.md).
+
+### Auth users
+
+The `auth_users` view lists internal {{ ydb-short-name }} [users](../concepts/glossary.md#access-user). It does not include users authenticated through external systems such as LDAP.
+
+This view can be fully accessed by database administrators, while regular users can only view their own details.
+
+Table Structure:
+
+| Column | Description |
+|--------|-------------|
+| `Sid` | SID of the user.<br />Type: `Utf8`.<br />Key: `0`. |
+| `IsEnabled` | Indicates if login is allowed; used for explicit administrator block. Independent of `IsLockedOut`.<br />Type: `Bool`. |
+| `IsLockedOut` | Automatically locked out due to exceeding failed login attempts. Independent of `IsEnabled`.<br />Type: `Bool`. |
+| `CreatedAt` | Timestamp of user creation.<br />Type: `Timestamp`. |
+| `LastSuccessfulAttemptAt` | Timestamp of the last successful login attempt.<br />Type: `Timestamp`. |
+| `LastFailedAttemptAt` | Timestamp of the last failed login attempt.<br />Type: `Timestamp`. |
+| `FailedAttemptCount` | Number of failed login attempts.<br />Type: `Uint32`. |
+| `PasswordHash` | JSON string containing password hash, salt, and hash algorithm.<br />Type: `Utf8`. |
path: ydb/docs/en/core/dev/system-views.md
user: login: kungasc
body: It's how we've already implemented it

May be fixed later, but currently the doc matches reality

@azevaykin what do you think about it?
created_at: 2025-03-10T08:29:06Z
author_association: CONTRIBUTOR
diff_hunk: @@ -299,3 +300,109 @@ ORDER BY IntervalEnd desc, CPUCores desc
 ```
 
 * `"YYYY-MM-DDTHH:MM:SS.UUUUUUZ"`: Time in the UTC 0 zone (`YYYY` stands for year, `MM`, for month, `DD`, for date, `hh`, for hours, `mm`, for minutes, `ss`, for seconds, and `uuuuuu`, for microseconds). For example, `"2023-01-26T13:00:00.000000Z"`.
+
+## Access control entities {#auth}
+
+The following system views store data for analyzing various [access control entities](../security/authorization.md).
+
+### Auth users
+
+The `auth_users` view lists internal {{ ydb-short-name }} [users](../concepts/glossary.md#access-user). It does not include users authenticated through external systems such as LDAP.
+
+This view can be fully accessed by database administrators, while regular users can only view their own details.
path: ydb/docs/en/core/dev/system-views.md
user: login: kungasc
body: @ijon @azevaykin please help with the question
created_at: 2025-03-10T09:10:41Z
author_association: CONTRIBUTOR
diff_hunk: @@ -299,3 +300,109 @@ ORDER BY IntervalEnd desc, CPUCores desc
 ```
 
 * `"YYYY-MM-DDTHH:MM:SS.UUUUUUZ"`: Time in the UTC 0 zone (`YYYY` stands for year, `MM`, for month, `DD`, for date, `hh`, for hours, `mm`, for minutes, `ss`, for seconds, and `uuuuuu`, for microseconds). For example, `"2023-01-26T13:00:00.000000Z"`.
+
+## Access control entities {#auth}
+
+The following system views store data for analyzing various [access control entities](../security/authorization.md).
+
+### Auth users
+
+The `auth_users` view lists internal {{ ydb-short-name }} [users](../concepts/glossary.md#access-user). It does not include users authenticated through external systems such as LDAP.
+
+This view can be fully accessed by database administrators, while regular users can only view their own details.
path: ydb/docs/en/core/dev/system-views.md
user: login: ijon
body: I would suggest changing "database admins" to plain "administrators" here -- 1) cluster admins also have access to the `auth_users`, 2) the concept of database admins is being introduced in the separate pr, that is still in review.
created_at: 2025-03-10T10:24:44Z
author_association: COLLABORATOR
diff_hunk: @@ -299,3 +300,109 @@ ORDER BY IntervalEnd desc, CPUCores desc
 ```
 
 * `"YYYY-MM-DDTHH:MM:SS.UUUUUUZ"`: Time in the UTC 0 zone (`YYYY` stands for year, `MM`, for month, `DD`, for date, `hh`, for hours, `mm`, for minutes, `ss`, for seconds, and `uuuuuu`, for microseconds). For example, `"2023-01-26T13:00:00.000000Z"`.
+
+## Access control entities {#auth}
+
+The following system views store data for analyzing various [access control entities](../security/authorization.md).
+
+### Auth users
+
+The `auth_users` view lists internal {{ ydb-short-name }} [users](../concepts/glossary.md#access-user). It does not include users authenticated through external systems such as LDAP.
+
+This view can be fully accessed by database administrators, while regular users can only view their own details.
path: ydb/docs/en/core/dev/system-views.md
user: login: kungasc
body: Thanks, in that case a link to administrator definition will be added later and do not block this PR.
created_at: 2025-03-10T11:28:45Z
author_association: CONTRIBUTOR
diff_hunk: @@ -299,3 +300,109 @@ ORDER BY IntervalEnd desc, CPUCores desc
 ```
 
 * `"YYYY-MM-DDTHH:MM:SS.UUUUUUZ"`: Time in the UTC 0 zone (`YYYY` stands for year, `MM`, for month, `DD`, for date, `hh`, for hours, `mm`, for minutes, `ss`, for seconds, and `uuuuuu`, for microseconds). For example, `"2023-01-26T13:00:00.000000Z"`.
+
+## Access control entities {#auth}
+
+The following system views store data for analyzing various [access control entities](../security/authorization.md).
+
+### Auth users
+
+The `auth_users` view lists internal {{ ydb-short-name }} [users](../concepts/glossary.md#access-user). It does not include users authenticated through external systems such as LDAP.
+
+This view can be fully accessed by database administrators, while regular users can only view their own details.
+
+Table Structure:
+
+| Column | Description |
+|--------|-------------|
+| `Sid` | SID of the user.<br />Type: `Utf8`.<br />Key: `0`. |
+| `IsEnabled` | Indicates if login is allowed; used for explicit administrator block. Independent of `IsLockedOut`.<br />Type: `Bool`. |
+| `IsLockedOut` | Automatically locked out due to exceeding failed login attempts. Independent of `IsEnabled`.<br />Type: `Bool`. |
+| `CreatedAt` | Timestamp of user creation.<br />Type: `Timestamp`. |
+| `LastSuccessfulAttemptAt` | Timestamp of the last successful login attempt.<br />Type: `Timestamp`. |
+| `LastFailedAttemptAt` | Timestamp of the last failed login attempt.<br />Type: `Timestamp`. |
+| `FailedAttemptCount` | Number of failed login attempts.<br />Type: `Uint32`. |
+| `PasswordHash` | JSON string containing password hash, salt, and hash algorithm.<br />Type: `Utf8`. |
path: ydb/docs/en/core/dev/system-views.md
user: login: kungasc
body: Anyway, this doesn't block this PR, as the doc describes the current state.
created_at: 2025-03-10T11:30:57Z
author_association: CONTRIBUTOR
diff_hunk: @@ -299,3 +300,109 @@ ORDER BY IntervalEnd desc, CPUCores desc
 ```
 
 * `"YYYY-MM-DDTHH:MM:SS.UUUUUUZ"`: Time in the UTC 0 zone (`YYYY` stands for year, `MM`, for month, `DD`, for date, `hh`, for hours, `mm`, for minutes, `ss`, for seconds, and `uuuuuu`, for microseconds). For example, `"2023-01-26T13:00:00.000000Z"`.
+
+## Access control entities {#auth}
+
+The following system views store data for analyzing various [access control entities](../security/authorization.md).
+
+### Auth users
+
+The `auth_users` view lists internal {{ ydb-short-name }} [users](../concepts/glossary.md#access-user). It does not include users authenticated through external systems such as LDAP.
+
+This view can be fully accessed by database administrators, while regular users can only view their own details.
path: ydb/docs/en/core/dev/system-views.md
user: login: kungasc
body: https://github.com/ydb-platform/ydb/issues/15949
created_at: 2025-03-19T11:31:11Z
author_association: CONTRIBUTOR

PR comments:
user: login: github-actions[bot]
created_at: 2025-03-06T13:23:10Z
body: <!-- status pr=15413, validate PR description status -->
:green_circle: `2025-03-19 11:23:07 UTC` The validation of the Pull Request description is successful.
author_association: NONE
user: login: github-actions[bot]
created_at: 2025-03-06T13:24:45Z
body: ### :x: Documentation build
Revision build failed

#### Build logs
##### Errors (3) 
  :x: /en/dev/system-views.md: 362: MD051/link-fragments Link fragments should be valid [Context: "[access object](#access-object)"]

  :x: /en/dev/system-views.md: 374: MD051/link-fragments Link fragments should be valid [Context: "[access objects](#access-object)"]

  :x: /en/dev/system-views.md: 376: MD051/link-fragments Link fragments should be valid [Context: "[access object](#access-object)"]




author_association: NONE
user: login: github-actions[bot]
created_at: 2025-03-06T13:25:48Z
body: <!-- status pr=15413, preset=release-asan, run=36409 -->
:white_circle: `2025-03-06 13:25:48 UTC` Pre-commit [check](https://github.com/ydb-platform/ydb/actions/runs/13699689898/job/38310127581) **linux-x86_64-release-asan** for 8b64275294316d0c51ef1b398671fd396fad8666 has started.
:white_circle: `2025-03-06 13:25:57 UTC` Artifacts will be uploaded [here](https://storage.yandexcloud.net/ydb-gh-logs/ydb-platform/ydb/PR-check/13699689898/ya-x86-64-asan/index.html)
:black_circle: `2025-03-06 13:27:35 UTC` Check cancelled
author_association: NONE
user: login: github-actions[bot]
created_at: 2025-03-06T13:28:41Z
body: <!-- status pr=15413, preset=release-asan, run=36413 -->
:white_circle: `2025-03-06 13:28:40 UTC` Pre-commit [check](https://github.com/ydb-platform/ydb/actions/runs/13699790160/job/38310479029) **linux-x86_64-release-asan** for 52e5f2c4f18cc1cdeaa2c44c8be435c4e813edb9 has started.
:white_circle: `2025-03-06 13:29:08 UTC` Artifacts will be uploaded [here](https://storage.yandexcloud.net/ydb-gh-logs/ydb-platform/ydb/PR-check/13699790160/ya-x86-64-asan/index.html)
:white_circle: `2025-03-06 13:32:02 UTC` ya make is running...
:green_circle: `2025-03-06 13:32:07 UTC` Tests successful.

[Test history](https://nebius.testmo.net/automation/runs/view/121362) | [Ya make output](https://storage.yandexcloud.net/ydb-gh-logs/ydb-platform/ydb/PR-check/13699790160/ya-x86-64-asan/ya_make_output.txt) | [Test bloat](https://storage.yandexcloud.net/ydb-gh-logs/ydb-platform/ydb/PR-check/13699790160/ya-x86-64-asan/try_1/test_bloat/tree_map.html)
| TESTS | PASSED | ERRORS | FAILED | SKIPPED | MUTED<sup>[?](https://github.com/ydb-platform/ydb/tree/main/.github/config/muted_ya.txt "All mute rules are defined here")</sup> |
| ---: | ---: | ---: | ---: | ---: | ---: |
| [0](https://storage.yandexcloud.net/ydb-gh-logs/ydb-platform/ydb/PR-check/13699790160/ya-x86-64-asan/try_1/ya-test.html) | 0 | 0 | 0 | 0 | 0 |

:green_circle: `2025-03-06 13:32:13 UTC` Build successful.
author_association: NONE
user: login: github-actions[bot]
created_at: 2025-03-06T13:35:48Z
body: <!-- status pr=15413, preset=relwithdebinfo, run=36413 -->
:white_circle: `2025-03-06 13:35:47 UTC` Pre-commit [check](https://github.com/ydb-platform/ydb/actions/runs/13699790160/job/38310478650) **linux-x86_64-relwithdebinfo** for 52e5f2c4f18cc1cdeaa2c44c8be435c4e813edb9 has started.
:white_circle: `2025-03-06 13:36:01 UTC` Artifacts will be uploaded [here](https://storage.yandexcloud.net/ydb-gh-logs/ydb-platform/ydb/PR-check/13699790160/ya-x86-64/index.html)
:white_circle: `2025-03-06 13:38:15 UTC` ya make is running...
:green_circle: `2025-03-06 13:38:20 UTC` Tests successful.

[Test history](https://nebius.testmo.net/automation/runs/view/121367) | [Ya make output](https://storage.yandexcloud.net/ydb-gh-logs/ydb-platform/ydb/PR-check/13699790160/ya-x86-64/ya_make_output.txt) | [Test bloat](https://storage.yandexcloud.net/ydb-gh-logs/ydb-platform/ydb/PR-check/13699790160/ya-x86-64/try_1/test_bloat/tree_map.html)
| TESTS | PASSED | ERRORS | FAILED | SKIPPED | MUTED<sup>[?](https://github.com/ydb-platform/ydb/tree/main/.github/config/muted_ya.txt "All mute rules are defined here")</sup> |
| ---: | ---: | ---: | ---: | ---: | ---: |
| [0](https://storage.yandexcloud.net/ydb-gh-logs/ydb-platform/ydb/PR-check/13699790160/ya-x86-64/try_1/ya-test.html) | 0 | 0 | 0 | 0 | 0 |

:green_circle: `2025-03-06 13:38:27 UTC` Build successful.
author_association: NONE
user: login: github-actions[bot]
created_at: 2025-03-06T14:04:21Z
body: ### :white_check_mark: Documentation build
Revision built successfully
Revision preview [link](https://ydb-platform--ydb.viewer.diplodoc.com?revision=pr-15413-c24cfb3a6d376e6f001a07c0dc0291f014f6f63a)


author_association: NONE
user: login: github-actions[bot]
created_at: 2025-03-06T14:56:44Z
body: <!-- status pr=15413, preset=relwithdebinfo, run=36430 -->
:white_circle: `2025-03-06 14:56:43 UTC` Pre-commit [check](https://github.com/ydb-platform/ydb/actions/runs/13701509311/job/38316258846) **linux-x86_64-relwithdebinfo** for 317fda523b00f04b4b698d68aa465f36e5a6aec0 has started.
:white_circle: `2025-03-06 14:57:06 UTC` Artifacts will be uploaded [here](https://storage.yandexcloud.net/ydb-gh-logs/ydb-platform/ydb/PR-check/13701509311/ya-x86-64/index.html)
:white_circle: `2025-03-06 14:59:24 UTC` ya make is running...
:green_circle: `2025-03-06 14:59:30 UTC` Tests successful.

[Test history](https://nebius.testmo.net/automation/runs/view/121428) | [Ya make output](https://storage.yandexcloud.net/ydb-gh-logs/ydb-platform/ydb/PR-check/13701509311/ya-x86-64/ya_make_output.txt) | [Test bloat](https://storage.yandexcloud.net/ydb-gh-logs/ydb-platform/ydb/PR-check/13701509311/ya-x86-64/try_1/test_bloat/tree_map.html)
| TESTS | PASSED | ERRORS | FAILED | SKIPPED | MUTED<sup>[?](https://github.com/ydb-platform/ydb/tree/main/.github/config/muted_ya.txt "All mute rules are defined here")</sup> |
| ---: | ---: | ---: | ---: | ---: | ---: |
| [0](https://storage.yandexcloud.net/ydb-gh-logs/ydb-platform/ydb/PR-check/13701509311/ya-x86-64/try_1/ya-test.html) | 0 | 0 | 0 | 0 | 0 |

:green_circle: `2025-03-06 14:59:35 UTC` Build successful.
author_association: NONE
user: login: github-actions[bot]
created_at: 2025-03-06T14:57:23Z
body: <!-- status pr=15413, preset=release-asan, run=36430 -->
:white_circle: `2025-03-06 14:57:23 UTC` Pre-commit [check](https://github.com/ydb-platform/ydb/actions/runs/13701509311/job/38316259312) **linux-x86_64-release-asan** for 317fda523b00f04b4b698d68aa465f36e5a6aec0 has started.
:white_circle: `2025-03-06 14:57:38 UTC` Artifacts will be uploaded [here](https://storage.yandexcloud.net/ydb-gh-logs/ydb-platform/ydb/PR-check/13701509311/ya-x86-64-asan/index.html)
:white_circle: `2025-03-06 14:59:58 UTC` ya make is running...
:green_circle: `2025-03-06 15:00:04 UTC` Tests successful.

[Test history](https://nebius.testmo.net/automation/runs/view/121431) | [Ya make output](https://storage.yandexcloud.net/ydb-gh-logs/ydb-platform/ydb/PR-check/13701509311/ya-x86-64-asan/ya_make_output.txt) | [Test bloat](https://storage.yandexcloud.net/ydb-gh-logs/ydb-platform/ydb/PR-check/13701509311/ya-x86-64-asan/try_1/test_bloat/tree_map.html)
| TESTS | PASSED | ERRORS | FAILED | SKIPPED | MUTED<sup>[?](https://github.com/ydb-platform/ydb/tree/main/.github/config/muted_ya.txt "All mute rules are defined here")</sup> |
| ---: | ---: | ---: | ---: | ---: | ---: |
| [0](https://storage.yandexcloud.net/ydb-gh-logs/ydb-platform/ydb/PR-check/13701509311/ya-x86-64-asan/try_1/ya-test.html) | 0 | 0 | 0 | 0 | 0 |

:green_circle: `2025-03-06 15:00:09 UTC` Build successful.
author_association: NONE
user: login: github-actions[bot]
created_at: 2025-03-06T14:58:06Z
body: ### :white_check_mark: Documentation build
Revision built successfully
Revision preview [link](https://ydb-platform--ydb.viewer.diplodoc.com?revision=pr-15413-11636d95e2be0941e77b2d52a1c24a5c992071d2)


author_association: NONE
user: login: github-actions[bot]
created_at: 2025-03-06T15:40:35Z
body: <!-- status pr=15413, preset=release-asan, run=36443 -->
:white_circle: `2025-03-06 15:40:34 UTC` Pre-commit [check](https://github.com/ydb-platform/ydb/actions/runs/13702467005/job/38319524769) **linux-x86_64-release-asan** for 81387f4c9d3130c7610367bbd292989779c88a65 has started.
:white_circle: `2025-03-06 15:41:06 UTC` Artifacts will be uploaded [here](https://storage.yandexcloud.net/ydb-gh-logs/ydb-platform/ydb/PR-check/13702467005/ya-x86-64-asan/index.html)
:white_circle: `2025-03-06 15:44:02 UTC` ya make is running...
:green_circle: `2025-03-06 15:44:07 UTC` Tests successful.

[Test history](https://nebius.testmo.net/automation/runs/view/121477) | [Ya make output](https://storage.yandexcloud.net/ydb-gh-logs/ydb-platform/ydb/PR-check/13702467005/ya-x86-64-asan/ya_make_output.txt) | [Test bloat](https://storage.yandexcloud.net/ydb-gh-logs/ydb-platform/ydb/PR-check/13702467005/ya-x86-64-asan/try_1/test_bloat/tree_map.html)
| TESTS | PASSED | ERRORS | FAILED | SKIPPED | MUTED<sup>[?](https://github.com/ydb-platform/ydb/tree/main/.github/config/muted_ya.txt "All mute rules are defined here")</sup> |
| ---: | ---: | ---: | ---: | ---: | ---: |
| [0](https://storage.yandexcloud.net/ydb-gh-logs/ydb-platform/ydb/PR-check/13702467005/ya-x86-64-asan/try_1/ya-test.html) | 0 | 0 | 0 | 0 | 0 |

:green_circle: `2025-03-06 15:44:13 UTC` Build successful.
author_association: NONE
user: login: github-actions[bot]
created_at: 2025-03-06T15:43:18Z
body: ### :white_check_mark: Documentation build
Revision built successfully
Revision preview [link](https://ydb-platform--ydb.viewer.diplodoc.com?revision=pr-15413-a5247f1b4352a451954a267923580e1e39dcc9d1)


author_association: NONE
user: login: github-actions[bot]
created_at: 2025-03-06T15:45:38Z
body: <!-- status pr=15413, preset=relwithdebinfo, run=36443 -->
:white_circle: `2025-03-06 15:45:38 UTC` Pre-commit [check](https://github.com/ydb-platform/ydb/actions/runs/13702467005/job/38319524230) **linux-x86_64-relwithdebinfo** for 81387f4c9d3130c7610367bbd292989779c88a65 has started.
:white_circle: `2025-03-06 15:45:53 UTC` Artifacts will be uploaded [here](https://storage.yandexcloud.net/ydb-gh-logs/ydb-platform/ydb/PR-check/13702467005/ya-x86-64/index.html)
:white_circle: `2025-03-06 15:48:10 UTC` ya make is running...
:green_circle: `2025-03-06 15:48:15 UTC` Tests successful.

[Test history](https://nebius.testmo.net/automation/runs/view/121480) | [Ya make output](https://storage.yandexcloud.net/ydb-gh-logs/ydb-platform/ydb/PR-check/13702467005/ya-x86-64/ya_make_output.txt) | [Test bloat](https://storage.yandexcloud.net/ydb-gh-logs/ydb-platform/ydb/PR-check/13702467005/ya-x86-64/try_1/test_bloat/tree_map.html)
| TESTS | PASSED | ERRORS | FAILED | SKIPPED | MUTED<sup>[?](https://github.com/ydb-platform/ydb/tree/main/.github/config/muted_ya.txt "All mute rules are defined here")</sup> |
| ---: | ---: | ---: | ---: | ---: | ---: |
| [0](https://storage.yandexcloud.net/ydb-gh-logs/ydb-platform/ydb/PR-check/13702467005/ya-x86-64/try_1/ya-test.html) | 0 | 0 | 0 | 0 | 0 |

:green_circle: `2025-03-06 15:48:21 UTC` Build successful.
author_association: NONE
user: login: github-actions[bot]
created_at: 2025-03-06T16:11:16Z
body: <!-- status pr=15413, preset=relwithdebinfo, run=36449 -->
:white_circle: `2025-03-06 16:11:16 UTC` Pre-commit [check](https://github.com/ydb-platform/ydb/actions/runs/13703067940/job/38321536593) **linux-x86_64-relwithdebinfo** for 4f500653042ce4d77f9f8d1a10a92c06705a1035 has started.
:white_circle: `2025-03-06 16:11:20 UTC` Artifacts will be uploaded [here](https://storage.yandexcloud.net/ydb-gh-logs/ydb-platform/ydb/PR-check/13703067940/ya-x86-64/index.html)
:white_circle: `2025-03-06 16:13:35 UTC` ya make is running...
:green_circle: `2025-03-06 16:13:41 UTC` Tests successful.

[Test history](https://nebius.testmo.net/automation/runs/view/121505) | [Ya make output](https://storage.yandexcloud.net/ydb-gh-logs/ydb-platform/ydb/PR-check/13703067940/ya-x86-64/ya_make_output.txt) | [Test bloat](https://storage.yandexcloud.net/ydb-gh-logs/ydb-platform/ydb/PR-check/13703067940/ya-x86-64/try_1/test_bloat/tree_map.html)
| TESTS | PASSED | ERRORS | FAILED | SKIPPED | MUTED<sup>[?](https://github.com/ydb-platform/ydb/tree/main/.github/config/muted_ya.txt "All mute rules are defined here")</sup> |
| ---: | ---: | ---: | ---: | ---: | ---: |
| [0](https://storage.yandexcloud.net/ydb-gh-logs/ydb-platform/ydb/PR-check/13703067940/ya-x86-64/try_1/ya-test.html) | 0 | 0 | 0 | 0 | 0 |

:green_circle: `2025-03-06 16:13:47 UTC` Build successful.
author_association: NONE
user: login: github-actions[bot]
created_at: 2025-03-06T16:11:18Z
body: <!-- status pr=15413, preset=release-asan, run=36449 -->
:white_circle: `2025-03-06 16:11:18 UTC` Pre-commit [check](https://github.com/ydb-platform/ydb/actions/runs/13703067940/job/38321537069) **linux-x86_64-release-asan** for 4f500653042ce4d77f9f8d1a10a92c06705a1035 has started.
:white_circle: `2025-03-06 16:11:22 UTC` Artifacts will be uploaded [here](https://storage.yandexcloud.net/ydb-gh-logs/ydb-platform/ydb/PR-check/13703067940/ya-x86-64-asan/index.html)
:white_circle: `2025-03-06 16:13:37 UTC` ya make is running...
:green_circle: `2025-03-06 16:13:43 UTC` Tests successful.

[Test history](https://nebius.testmo.net/automation/runs/view/121506) | [Ya make output](https://storage.yandexcloud.net/ydb-gh-logs/ydb-platform/ydb/PR-check/13703067940/ya-x86-64-asan/ya_make_output.txt) | [Test bloat](https://storage.yandexcloud.net/ydb-gh-logs/ydb-platform/ydb/PR-check/13703067940/ya-x86-64-asan/try_1/test_bloat/tree_map.html)
| TESTS | PASSED | ERRORS | FAILED | SKIPPED | MUTED<sup>[?](https://github.com/ydb-platform/ydb/tree/main/.github/config/muted_ya.txt "All mute rules are defined here")</sup> |
| ---: | ---: | ---: | ---: | ---: | ---: |
| [0](https://storage.yandexcloud.net/ydb-gh-logs/ydb-platform/ydb/PR-check/13703067940/ya-x86-64-asan/try_1/ya-test.html) | 0 | 0 | 0 | 0 | 0 |

:green_circle: `2025-03-06 16:13:49 UTC` Build successful.
author_association: NONE
user: login: github-actions[bot]
created_at: 2025-03-06T16:12:32Z
body: ### :white_check_mark: Documentation build
Revision built successfully
Revision preview [link](https://ydb-platform--ydb.viewer.diplodoc.com?revision=pr-15413-9373cc5cdfd596077a95225f246a3ad4f14e1d06)


author_association: NONE
user: login: github-actions[bot]
created_at: 2025-03-07T08:56:29Z
body: ### :white_check_mark: Documentation build
Revision built successfully
Revision preview [link](https://ydb-platform--ydb.viewer.diplodoc.com?revision=pr-15413-18b762044de7859870e4b142c9215f3d8bd98b69)


author_association: NONE
user: login: github-actions[bot]
created_at: 2025-03-07T08:57:10Z
body: <!-- status pr=15413, preset=release-asan, run=36500 -->
:white_circle: `2025-03-07 08:57:09 UTC` Pre-commit [check](https://github.com/ydb-platform/ydb/actions/runs/13717125123/job/38364261902) **linux-x86_64-release-asan** for 364caf9812f24e4f299f2d4f29b5945a2d363c6a has started.
:white_circle: `2025-03-07 08:57:25 UTC` Artifacts will be uploaded [here](https://storage.yandexcloud.net/ydb-gh-logs/ydb-platform/ydb/PR-check/13717125123/ya-x86-64-asan/index.html)
:white_circle: `2025-03-07 08:59:43 UTC` ya make is running...
:green_circle: `2025-03-07 08:59:49 UTC` Tests successful.

[Test history](https://nebius.testmo.net/automation/runs/view/121846) | [Ya make output](https://storage.yandexcloud.net/ydb-gh-logs/ydb-platform/ydb/PR-check/13717125123/ya-x86-64-asan/ya_make_output.txt) | [Test bloat](https://storage.yandexcloud.net/ydb-gh-logs/ydb-platform/ydb/PR-check/13717125123/ya-x86-64-asan/try_1/test_bloat/tree_map.html)
| TESTS | PASSED | ERRORS | FAILED | SKIPPED | MUTED<sup>[?](https://github.com/ydb-platform/ydb/tree/main/.github/config/muted_ya.txt "All mute rules are defined here")</sup> |
| ---: | ---: | ---: | ---: | ---: | ---: |
| [0](https://storage.yandexcloud.net/ydb-gh-logs/ydb-platform/ydb/PR-check/13717125123/ya-x86-64-asan/try_1/ya-test.html) | 0 | 0 | 0 | 0 | 0 |

:green_circle: `2025-03-07 08:59:54 UTC` Build successful.
author_association: NONE
user: login: github-actions[bot]
created_at: 2025-03-07T08:57:12Z
body: <!-- status pr=15413, preset=relwithdebinfo, run=36500 -->
:white_circle: `2025-03-07 08:57:12 UTC` Pre-commit [check](https://github.com/ydb-platform/ydb/actions/runs/13717125123/job/38364261903) **linux-x86_64-relwithdebinfo** for 364caf9812f24e4f299f2d4f29b5945a2d363c6a has started.
:white_circle: `2025-03-07 08:57:27 UTC` Artifacts will be uploaded [here](https://storage.yandexcloud.net/ydb-gh-logs/ydb-platform/ydb/PR-check/13717125123/ya-x86-64/index.html)
:white_circle: `2025-03-07 08:59:46 UTC` ya make is running...
:green_circle: `2025-03-07 08:59:51 UTC` Tests successful.

[Test history](https://nebius.testmo.net/automation/runs/view/121847) | [Ya make output](https://storage.yandexcloud.net/ydb-gh-logs/ydb-platform/ydb/PR-check/13717125123/ya-x86-64/ya_make_output.txt) | [Test bloat](https://storage.yandexcloud.net/ydb-gh-logs/ydb-platform/ydb/PR-check/13717125123/ya-x86-64/try_1/test_bloat/tree_map.html)
| TESTS | PASSED | ERRORS | FAILED | SKIPPED | MUTED<sup>[?](https://github.com/ydb-platform/ydb/tree/main/.github/config/muted_ya.txt "All mute rules are defined here")</sup> |
| ---: | ---: | ---: | ---: | ---: | ---: |
| [0](https://storage.yandexcloud.net/ydb-gh-logs/ydb-platform/ydb/PR-check/13717125123/ya-x86-64/try_1/ya-test.html) | 0 | 0 | 0 | 0 | 0 |

:green_circle: `2025-03-07 08:59:57 UTC` Build successful.
author_association: NONE
user: login: github-actions[bot]
created_at: 2025-03-10T08:19:28Z
body: ### :white_check_mark: Documentation build
Revision built successfully
Revision preview [link](https://ydb-platform--ydb.viewer.diplodoc.com?revision=pr-15413-5005b62102d668f0e09215a5ddfa84d7892c018a)


author_association: NONE
user: login: github-actions[bot]
created_at: 2025-03-10T08:19:36Z
body: <!-- status pr=15413, preset=relwithdebinfo, run=36626 -->
:white_circle: `2025-03-10 08:19:36 UTC` Pre-commit [check](https://github.com/ydb-platform/ydb/actions/runs/13759885397/job/38473589880) **linux-x86_64-relwithdebinfo** for a665193ac6c88a08074ba2246a4b05f8d2c149b5 has started.
:white_circle: `2025-03-10 08:19:51 UTC` Artifacts will be uploaded [here](https://storage.yandexcloud.net/ydb-gh-logs/ydb-platform/ydb/PR-check/13759885397/ya-x86-64/index.html)
:white_circle: `2025-03-10 08:22:11 UTC` ya make is running...
:green_circle: `2025-03-10 08:22:16 UTC` Tests successful.

[Test history](https://nebius.testmo.net/automation/runs/view/122711) | [Ya make output](https://storage.yandexcloud.net/ydb-gh-logs/ydb-platform/ydb/PR-check/13759885397/ya-x86-64/ya_make_output.txt) | [Test bloat](https://storage.yandexcloud.net/ydb-gh-logs/ydb-platform/ydb/PR-check/13759885397/ya-x86-64/try_1/test_bloat/tree_map.html)
| TESTS | PASSED | ERRORS | FAILED | SKIPPED | MUTED<sup>[?](https://github.com/ydb-platform/ydb/tree/main/.github/config/muted_ya.txt "All mute rules are defined here")</sup> |
| ---: | ---: | ---: | ---: | ---: | ---: |
| [0](https://storage.yandexcloud.net/ydb-gh-logs/ydb-platform/ydb/PR-check/13759885397/ya-x86-64/try_1/ya-test.html) | 0 | 0 | 0 | 0 | 0 |

:green_circle: `2025-03-10 08:22:22 UTC` Build successful.
author_association: NONE
user: login: github-actions[bot]
created_at: 2025-03-10T08:20:01Z
body: <!-- status pr=15413, preset=release-asan, run=36626 -->
:white_circle: `2025-03-10 08:20:01 UTC` Pre-commit [check](https://github.com/ydb-platform/ydb/actions/runs/13759885397/job/38473590223) **linux-x86_64-release-asan** for a665193ac6c88a08074ba2246a4b05f8d2c149b5 has started.
:white_circle: `2025-03-10 08:20:16 UTC` Artifacts will be uploaded [here](https://storage.yandexcloud.net/ydb-gh-logs/ydb-platform/ydb/PR-check/13759885397/ya-x86-64-asan/index.html)
:white_circle: `2025-03-10 08:22:36 UTC` ya make is running...
:green_circle: `2025-03-10 08:22:42 UTC` Tests successful.

[Test history](https://nebius.testmo.net/automation/runs/view/122713) | [Ya make output](https://storage.yandexcloud.net/ydb-gh-logs/ydb-platform/ydb/PR-check/13759885397/ya-x86-64-asan/ya_make_output.txt) | [Test bloat](https://storage.yandexcloud.net/ydb-gh-logs/ydb-platform/ydb/PR-check/13759885397/ya-x86-64-asan/try_1/test_bloat/tree_map.html)
| TESTS | PASSED | ERRORS | FAILED | SKIPPED | MUTED<sup>[?](https://github.com/ydb-platform/ydb/tree/main/.github/config/muted_ya.txt "All mute rules are defined here")</sup> |
| ---: | ---: | ---: | ---: | ---: | ---: |
| [0](https://storage.yandexcloud.net/ydb-gh-logs/ydb-platform/ydb/PR-check/13759885397/ya-x86-64-asan/try_1/ya-test.html) | 0 | 0 | 0 | 0 | 0 |

:green_circle: `2025-03-10 08:22:48 UTC` Build successful.
author_association: NONE
user: login: github-actions[bot]
created_at: 2025-03-10T08:33:41Z
body: <!-- status pr=15413, preset=relwithdebinfo, run=36628 -->
:white_circle: `2025-03-10 08:33:40 UTC` Pre-commit [check](https://github.com/ydb-platform/ydb/actions/runs/13760141053/job/38474318184) **linux-x86_64-relwithdebinfo** for 64831f6776a77e3347e923317a2fca331fd277b8 has started.
:white_circle: `2025-03-10 08:33:56 UTC` Artifacts will be uploaded [here](https://storage.yandexcloud.net/ydb-gh-logs/ydb-platform/ydb/PR-check/13760141053/ya-x86-64/index.html)
:white_circle: `2025-03-10 08:36:14 UTC` ya make is running...
:green_circle: `2025-03-10 08:36:19 UTC` Tests successful.

[Test history](https://nebius.testmo.net/automation/runs/view/122721) | [Ya make output](https://storage.yandexcloud.net/ydb-gh-logs/ydb-platform/ydb/PR-check/13760141053/ya-x86-64/ya_make_output.txt) | [Test bloat](https://storage.yandexcloud.net/ydb-gh-logs/ydb-platform/ydb/PR-check/13760141053/ya-x86-64/try_1/test_bloat/tree_map.html)
| TESTS | PASSED | ERRORS | FAILED | SKIPPED | MUTED<sup>[?](https://github.com/ydb-platform/ydb/tree/main/.github/config/muted_ya.txt "All mute rules are defined here")</sup> |
| ---: | ---: | ---: | ---: | ---: | ---: |
| [0](https://storage.yandexcloud.net/ydb-gh-logs/ydb-platform/ydb/PR-check/13760141053/ya-x86-64/try_1/ya-test.html) | 0 | 0 | 0 | 0 | 0 |

:green_circle: `2025-03-10 08:36:25 UTC` Build successful.
author_association: NONE
user: login: github-actions[bot]
created_at: 2025-03-10T08:33:45Z
body: ### :white_check_mark: Documentation build
Revision built successfully
Revision preview [link](https://ydb-platform--ydb.viewer.diplodoc.com?revision=pr-15413-59eaf1146952f02045c423cf6a5737b77a51f793)


author_association: NONE
user: login: github-actions[bot]
created_at: 2025-03-10T08:33:54Z
body: <!-- status pr=15413, preset=release-asan, run=36628 -->
:white_circle: `2025-03-10 08:33:54 UTC` Pre-commit [check](https://github.com/ydb-platform/ydb/actions/runs/13760141053/job/38474318490) **linux-x86_64-release-asan** for 64831f6776a77e3347e923317a2fca331fd277b8 has started.
:white_circle: `2025-03-10 08:34:09 UTC` Artifacts will be uploaded [here](https://storage.yandexcloud.net/ydb-gh-logs/ydb-platform/ydb/PR-check/13760141053/ya-x86-64-asan/index.html)
:white_circle: `2025-03-10 08:36:20 UTC` ya make is running...
:green_circle: `2025-03-10 08:36:26 UTC` Tests successful.

[Test history](https://nebius.testmo.net/automation/runs/view/122722) | [Ya make output](https://storage.yandexcloud.net/ydb-gh-logs/ydb-platform/ydb/PR-check/13760141053/ya-x86-64-asan/ya_make_output.txt) | [Test bloat](https://storage.yandexcloud.net/ydb-gh-logs/ydb-platform/ydb/PR-check/13760141053/ya-x86-64-asan/try_1/test_bloat/tree_map.html)
| TESTS | PASSED | ERRORS | FAILED | SKIPPED | MUTED<sup>[?](https://github.com/ydb-platform/ydb/tree/main/.github/config/muted_ya.txt "All mute rules are defined here")</sup> |
| ---: | ---: | ---: | ---: | ---: | ---: |
| [0](https://storage.yandexcloud.net/ydb-gh-logs/ydb-platform/ydb/PR-check/13760141053/ya-x86-64-asan/try_1/ya-test.html) | 0 | 0 | 0 | 0 | 0 |

:green_circle: `2025-03-10 08:36:31 UTC` Build successful.
author_association: NONE
user: login: github-actions[bot]
created_at: 2025-03-10T11:30:30Z
body: <!-- status pr=15413, preset=release-asan, run=36657 -->
:white_circle: `2025-03-10 11:30:29 UTC` Pre-commit [check](https://github.com/ydb-platform/ydb/actions/runs/13763545614/job/38484755119) **linux-x86_64-release-asan** for 097130ab26838daa696a216ce7115b94e147af92 has started.
:white_circle: `2025-03-10 11:30:35 UTC` Artifacts will be uploaded [here](https://storage.yandexcloud.net/ydb-gh-logs/ydb-platform/ydb/PR-check/13763545614/ya-x86-64-asan/index.html)
:white_circle: `2025-03-10 11:32:54 UTC` ya make is running...
:green_circle: `2025-03-10 11:33:00 UTC` Tests successful.

[Test history](https://nebius.testmo.net/automation/runs/view/122846) | [Ya make output](https://storage.yandexcloud.net/ydb-gh-logs/ydb-platform/ydb/PR-check/13763545614/ya-x86-64-asan/ya_make_output.txt) | [Test bloat](https://storage.yandexcloud.net/ydb-gh-logs/ydb-platform/ydb/PR-check/13763545614/ya-x86-64-asan/try_1/test_bloat/tree_map.html)
| TESTS | PASSED | ERRORS | FAILED | SKIPPED | MUTED<sup>[?](https://github.com/ydb-platform/ydb/tree/main/.github/config/muted_ya.txt "All mute rules are defined here")</sup> |
| ---: | ---: | ---: | ---: | ---: | ---: |
| [0](https://storage.yandexcloud.net/ydb-gh-logs/ydb-platform/ydb/PR-check/13763545614/ya-x86-64-asan/try_1/ya-test.html) | 0 | 0 | 0 | 0 | 0 |

:green_circle: `2025-03-10 11:33:06 UTC` Build successful.
author_association: NONE
user: login: github-actions[bot]
created_at: 2025-03-10T11:30:30Z
body: ### :x: Documentation build
Revision build failed

#### Build logs
##### Errors (8) 
  :x: /en/devops/ansible/initial-deployment.md: 2: MD031/blanks-around-fences Fenced code blocks should be surrounded by blank lines

  :x: /en/postgresql/statements/delete_from.md: 2: MD031/blanks-around-fences Fenced code blocks should be surrounded by blank lines

  :x: /en/postgresql/statements/drop_table.md: 2: MD031/blanks-around-fences Fenced code blocks should be surrounded by blank lines

  :x: /en/postgresql/statements/insert_into.md: 2: MD031/blanks-around-fences Fenced code blocks should be surrounded by blank lines

  :x: /en/yql/reference/syntax/expressions.md: 2: MD031/blanks-around-fences Fenced code blocks should be surrounded by blank lines

  :x: /en/yql/reference/types/primitive.md: 2: MD031/blanks-around-fences Fenced code blocks should be surrounded by blank lines

  :x: /ru/yql/reference/syntax/expressions.md: 2: MD031/blanks-around-fences Fenced code blocks should be surrounded by blank lines

  :x: /ru/yql/reference/types/primitive.md: 2: MD031/blanks-around-fences Fenced code blocks should be surrounded by blank lines

##### Warnings (676) 
  ⚠️ Title not found: ../../../yql/reference/syntax/create_table/with.md#time-to-live in /en/concepts/datamodel/_includes/table.md

  ⚠️ Title not found: ../../../yql/reference/syntax/create_table/with.md#time-to-live in /ru/concepts/datamodel/_includes/table.md

  ⚠️ Variable airflow-name not found in /en/integrations/orchestration/_includes/toc-table.md

  ⚠️ Variable airflow-name not found in /ru/integrations/orchestration/_includes/toc-table.md

  ⚠️ Variable azure_docs not found in /en/devops/ansible/_includes/terraform/azure.md

  ⚠️ Variable azure_docs not found in /ru/devops/ansible/_includes/terraform/azure.md

  ⚠️ Variable backend_name not found in /en/yql/reference/syntax/create_table/with.md

  ⚠️ Variable backend_name not found in /ru/yql/reference/syntax/create_table/with.md

  ⚠️ Variable concept_table not found in /en/yql/reference/syntax/create_table/with.md

  ⚠️ Variable concept_table not found in /ru/yql/reference/syntax/create_table/with.md

  ⚠️ Variable lang not found in /ru/_includes/parameterized-query.md

  ⚠️ Variable lang not found in /ru/reference/ydb-cli/parameterized-queries-cli.md

  ⚠️ Variable objstorage-full-name not found in /en/concepts/federated_query/s3/external_data_source.md

  ⚠️ Variable objstorage-name not found in /en/concepts/_includes/ttl.md

  ⚠️ Variable objstorage-name not found in /en/concepts/federated_query/s3/external_table.md

Log was truncated. (661 records)



author_association: NONE
user: login: github-actions[bot]
created_at: 2025-03-10T11:32:19Z
body: <!-- status pr=15413, preset=relwithdebinfo, run=36657 -->
:white_circle: `2025-03-10 11:32:19 UTC` Pre-commit [check](https://github.com/ydb-platform/ydb/actions/runs/13763545614/job/38484754827) **linux-x86_64-relwithdebinfo** for 097130ab26838daa696a216ce7115b94e147af92 has started.
:white_circle: `2025-03-10 11:32:29 UTC` Artifacts will be uploaded [here](https://storage.yandexcloud.net/ydb-gh-logs/ydb-platform/ydb/PR-check/13763545614/ya-x86-64/index.html)
:white_circle: `2025-03-10 11:34:42 UTC` ya make is running...
:green_circle: `2025-03-10 11:34:48 UTC` Tests successful.

[Test history](https://nebius.testmo.net/automation/runs/view/122849) | [Ya make output](https://storage.yandexcloud.net/ydb-gh-logs/ydb-platform/ydb/PR-check/13763545614/ya-x86-64/ya_make_output.txt) | [Test bloat](https://storage.yandexcloud.net/ydb-gh-logs/ydb-platform/ydb/PR-check/13763545614/ya-x86-64/try_1/test_bloat/tree_map.html)
| TESTS | PASSED | ERRORS | FAILED | SKIPPED | MUTED<sup>[?](https://github.com/ydb-platform/ydb/tree/main/.github/config/muted_ya.txt "All mute rules are defined here")</sup> |
| ---: | ---: | ---: | ---: | ---: | ---: |
| [0](https://storage.yandexcloud.net/ydb-gh-logs/ydb-platform/ydb/PR-check/13763545614/ya-x86-64/try_1/ya-test.html) | 0 | 0 | 0 | 0 | 0 |

:green_circle: `2025-03-10 11:34:54 UTC` Build successful.
author_association: NONE
user: login: github-actions[bot]
created_at: 2025-03-11T13:59:08Z
body: <!-- status pr=15413, preset=relwithdebinfo, run=36827 -->
:white_circle: `2025-03-11 13:59:07 UTC` Pre-commit [check](https://github.com/ydb-platform/ydb/actions/runs/13789861593/job/38566639053) **linux-x86_64-relwithdebinfo** for 12ada48bdab2c8d90c87a1667ad35db5e721f650 has started.
:white_circle: `2025-03-11 13:59:23 UTC` Artifacts will be uploaded [here](https://storage.yandexcloud.net/ydb-gh-logs/ydb-platform/ydb/PR-check/13789861593/ya-x86-64/index.html)
:white_circle: `2025-03-11 14:01:39 UTC` ya make is running...
:green_circle: `2025-03-11 14:01:45 UTC` Tests successful.

[Test history](https://nebius.testmo.net/automation/runs/view/123596) | [Ya make output](https://storage.yandexcloud.net/ydb-gh-logs/ydb-platform/ydb/PR-check/13789861593/ya-x86-64/ya_make_output.txt) | [Test bloat](https://storage.yandexcloud.net/ydb-gh-logs/ydb-platform/ydb/PR-check/13789861593/ya-x86-64/try_1/test_bloat/tree_map.html)
| TESTS | PASSED | ERRORS | FAILED | SKIPPED | MUTED<sup>[?](https://github.com/ydb-platform/ydb/tree/main/.github/config/muted_ya.txt "All mute rules are defined here")</sup> |
| ---: | ---: | ---: | ---: | ---: | ---: |
| [0](https://storage.yandexcloud.net/ydb-gh-logs/ydb-platform/ydb/PR-check/13789861593/ya-x86-64/try_1/ya-test.html) | 0 | 0 | 0 | 0 | 0 |

:green_circle: `2025-03-11 14:01:50 UTC` Build successful.
author_association: NONE
user: login: github-actions[bot]
created_at: 2025-03-11T14:01:36Z
body: <!-- status pr=15413, preset=release-asan, run=36827 -->
:white_circle: `2025-03-11 14:01:35 UTC` Pre-commit [check](https://github.com/ydb-platform/ydb/actions/runs/13789861593/job/38566639656) **linux-x86_64-release-asan** for 12ada48bdab2c8d90c87a1667ad35db5e721f650 has started.
:white_circle: `2025-03-11 14:01:49 UTC` Artifacts will be uploaded [here](https://storage.yandexcloud.net/ydb-gh-logs/ydb-platform/ydb/PR-check/13789861593/ya-x86-64-asan/index.html)
:white_circle: `2025-03-11 14:04:03 UTC` ya make is running...
:green_circle: `2025-03-11 14:04:14 UTC` Tests successful.

[Test history](https://nebius.testmo.net/automation/runs/view/123600) | [Ya make output](https://storage.yandexcloud.net/ydb-gh-logs/ydb-platform/ydb/PR-check/13789861593/ya-x86-64-asan/ya_make_output.txt) | [Test bloat](https://storage.yandexcloud.net/ydb-gh-logs/ydb-platform/ydb/PR-check/13789861593/ya-x86-64-asan/try_1/test_bloat/tree_map.html)
| TESTS | PASSED | ERRORS | FAILED | SKIPPED | MUTED<sup>[?](https://github.com/ydb-platform/ydb/tree/main/.github/config/muted_ya.txt "All mute rules are defined here")</sup> |
| ---: | ---: | ---: | ---: | ---: | ---: |
| [0](https://storage.yandexcloud.net/ydb-gh-logs/ydb-platform/ydb/PR-check/13789861593/ya-x86-64-asan/try_1/ya-test.html) | 0 | 0 | 0 | 0 | 0 |

:green_circle: `2025-03-11 14:04:21 UTC` Build successful.
author_association: NONE
user: login: github-actions[bot]
created_at: 2025-03-11T14:17:42Z
body: ### :white_check_mark: Documentation build
Revision built successfully
Revision preview [link](https://ydb-platform--ydb.viewer.diplodoc.com?revision=pr-15413-2fbe38bcd23874fea2046c40b652b8ddc56efa2e)


author_association: NONE