Skip to content

Commit cfb1ce3

Browse files
Update modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc
Co-authored-by: Phil Wright <[email protected]>
1 parent 1a03007 commit cfb1ce3

File tree

1 file changed

+5
-4
lines changed

1 file changed

+5
-4
lines changed

modules/ROOT/pages/authentication-authorization/immutable-roles-privileges.adoc

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -84,11 +84,12 @@ SHOW PRIVILEGES WHERE IMMUTABLE
8484
The result shows that all users are restricted from adding or removing privileges, including the `admin` user.
8585
. Ensure you have completed steps 4 and 5 from <<administer-immutable-roles-and-privileges>>.
8686

87-
=== Restricting the actions of users who can manage roles and privileges
87+
=== Creating permanent roles which cannot be changed
88+
89+
You can use immutable roles to create permanent built-in system roles that cannot be modified even by users who have xref:authentication-authorization/dbms-administration.adoc#access-control-dbms-administration-role-management[`ROLE MANAGEMENT` privileges].
90+
91+
For example, you want to create an `analyst` role that cannot be dropped, renamed, or have any of its privileges changed (even by users with the `ROLE MANAGEMENT` and `PRIVILEGE MANAGEMENT` privileges).
8892

89-
If you want permanent privileges but with more control over which users they apply to, you need to use immutable roles with immutable privileges.
90-
For example, you have a user called `alice` who has `ROLE MANAGEMENT` and `PRIVILEGE MANAGEMENT` privileges.
91-
To prevent `alice` from dropping any databases and from being able to remove this restriction using their `ROLE MANAGEMENT` and `PRIVILEGE MANAGEMENT` privileges, follow these steps:
9293

9394
. Ensure that you have completed steps 1 an 2 from <<administer-immutable-roles-and-privileges>>.
9495
. Create an immutable role to hold the immutable privileges:

0 commit comments

Comments
 (0)