From bed3016d777c0a7bc573679bce93eaf82ea0a00e Mon Sep 17 00:00:00 2001 From: Priyanka Danesh Gunaki Date: Thu, 25 Jun 2026 11:00:31 +0530 Subject: [PATCH 1/3] DOC-1731 add eg links --- modules/admin-portal/pages/management/user-management.adoc | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/modules/admin-portal/pages/management/user-management.adoc b/modules/admin-portal/pages/management/user-management.adoc index ce4550a..a1192d1 100644 --- a/modules/admin-portal/pages/management/user-management.adoc +++ b/modules/admin-portal/pages/management/user-management.adoc @@ -136,6 +136,10 @@ When you grant local privileges, you have the ability to grant `READ_DATA`, `CRE * Vertex or edge level: Grants access to all data on the specified vertices and edges, but not others. * Data level: Grants access to the specified attributes on the specified vertices and edges, but not other attributes on those or other vertices or edges. +For examples of granting type-level privileges using RBAC syntax, see xref:{page-component-version}@tigergraph-server:user-access:role-management.adoc#_grant_type_level_privilege_to_a_role[Grant type-level privilege to a role]. + +For examples of granting attribute-level privileges using RBAC syntax, see xref:{page-component-version}@tigergraph-server:user-access:role-management.adoc#_grant_attribute_level_privilege_to_a_role[Grant attribute-level privilege to a role]. + Because of the granularity offered with this feature, the expanded window for some graphs is quite large. This example uses the ldbc_snb graph, which has too many vertex properties to see on one screen. Just the properties for one vertex type, Comment, are shown here. From 2768c0585ab3f0a03c84abcbf4c7717f5a0f226b Mon Sep 17 00:00:00 2001 From: priyankagunaki-cloud Date: Wed, 8 Jul 2026 16:49:15 +0530 Subject: [PATCH 2/3] Update user-management.adoc --- .../pages/management/user-management.adoc | 40 +++++++++++++++++-- 1 file changed, 36 insertions(+), 4 deletions(-) diff --git a/modules/admin-portal/pages/management/user-management.adoc b/modules/admin-portal/pages/management/user-management.adoc index a1192d1..b7d1a96 100644 --- a/modules/admin-portal/pages/management/user-management.adoc +++ b/modules/admin-portal/pages/management/user-management.adoc @@ -136,10 +136,6 @@ When you grant local privileges, you have the ability to grant `READ_DATA`, `CRE * Vertex or edge level: Grants access to all data on the specified vertices and edges, but not others. * Data level: Grants access to the specified attributes on the specified vertices and edges, but not other attributes on those or other vertices or edges. -For examples of granting type-level privileges using RBAC syntax, see xref:{page-component-version}@tigergraph-server:user-access:role-management.adoc#_grant_type_level_privilege_to_a_role[Grant type-level privilege to a role]. - -For examples of granting attribute-level privileges using RBAC syntax, see xref:{page-component-version}@tigergraph-server:user-access:role-management.adoc#_grant_attribute_level_privilege_to_a_role[Grant attribute-level privilege to a role]. - Because of the granularity offered with this feature, the expanded window for some graphs is quite large. This example uses the ldbc_snb graph, which has too many vertex properties to see on one screen. Just the properties for one vertex type, Comment, are shown here. @@ -156,6 +152,42 @@ image::user-query-permissions.png[] The results can be filtered with the btn:[Add a filter] button, which is useful for large and complex graphs. Enter text into this field to only return vertices and attributes that match the filter. +== Grant type-level privilege to a role + +Type-level privileges allow users to access all attributes of a specific vertex or edge type in a graph. Grant these privileges through the Admin Portal before users access the graph from GraphStudio. + +To grant a type-level privilege: + +. Navigate to *User Management* > *User-defined Roles*. +. Create a new role or edit an existing role. +. Under *Local privileges*, select the target graph. +. Expand the graph to display the available vertex and edge types. +. Select the required vertex or edge type. +. Grant the required data privilege (`READ_DATA`, `CREATE_DATA`, or `UPDATE_DATA`). +. Click *Save* to save the role. +. Navigate to *Role Management*. +. Assign the role to the required user. + +After the role is assigned, the user can access all attributes of the selected vertex or edge type in GraphStudio. + +== Grant attribute-level privilege to a role + +Attribute-level privileges allow users to access specific attributes of a vertex or edge type in a graph. Grant these privileges through the Admin Portal before users access the graph from GraphStudio. + +To grant an attribute-level privilege: + +. Navigate to *User Management* > *User-defined Roles*. +. Create a new role or edit an existing role. +. Under *Local privileges*, select the target graph. +. Expand the required vertex or edge type to display its attributes. +. Select the required attribute or attributes. +. Grant the required data privilege (`READ_DATA`, `CREATE_DATA`, or `UPDATE_DATA`). +. Click *Save* to save the role. +. Navigate to *Role Management*. +. Assign the role to the required user. + +After the role is assigned, the user can access only the selected attributes of the vertex or edge type in GraphStudio. + === Edit a user-defined role Click image:edit.png[] to open the privileges menu again for editing. From 71907745b1389536e244d9d6f42cd94aae87a542 Mon Sep 17 00:00:00 2001 From: priyankagunaki-cloud Date: Wed, 8 Jul 2026 17:06:46 +0530 Subject: [PATCH 3/3] Update user-management.adoc --- .../pages/management/user-management.adoc | 58 +++++++++++++------ 1 file changed, 41 insertions(+), 17 deletions(-) diff --git a/modules/admin-portal/pages/management/user-management.adoc b/modules/admin-portal/pages/management/user-management.adoc index b7d1a96..ac4da1c 100644 --- a/modules/admin-portal/pages/management/user-management.adoc +++ b/modules/admin-portal/pages/management/user-management.adoc @@ -152,41 +152,65 @@ image::user-query-permissions.png[] The results can be filtered with the btn:[Add a filter] button, which is useful for large and complex graphs. Enter text into this field to only return vertices and attributes that match the filter. -== Grant type-level privilege to a role +==== Grant type-level privilege to a role Type-level privileges allow users to access all attributes of a specific vertex or edge type in a graph. Grant these privileges through the Admin Portal before users access the graph from GraphStudio. +Consider the following schema: + +[source,gsql] +---- +CREATE VERTEX person(id UINT PRIMARY KEY, name STRING) +CREATE VERTEX city(id UINT PRIMARY KEY, name STRING) +CREATE GRAPH G1(person, city) +---- + +Suppose a GraphStudio user needs to access all attributes of the `city` vertex type in graph `G1`. Grant the `READ_DATA` privilege on the `city` vertex type through the Admin Portal. + To grant a type-level privilege: -. Navigate to *User Management* > *User-defined Roles*. +. Navigate to *User Management*. +. Open the *User-defined Roles* tab. . Create a new role or edit an existing role. -. Under *Local privileges*, select the target graph. +. Under *Local privileges*, select graph `G1`. . Expand the graph to display the available vertex and edge types. -. Select the required vertex or edge type. -. Grant the required data privilege (`READ_DATA`, `CREATE_DATA`, or `UPDATE_DATA`). -. Click *Save* to save the role. -. Navigate to *Role Management*. +. Select the `city` vertex type. +. Grant the `READ_DATA` privilege. +. Save the role. +. Open the *Role Management* tab. . Assign the role to the required user. -After the role is assigned, the user can access all attributes of the selected vertex or edge type in GraphStudio. +After the role is assigned, the user can access all attributes of the `city` vertex type in GraphStudio. -== Grant attribute-level privilege to a role +==== Grant attribute-level privilege to a role Attribute-level privileges allow users to access specific attributes of a vertex or edge type in a graph. Grant these privileges through the Admin Portal before users access the graph from GraphStudio. +Consider the following schema: + +[source,gsql] +---- +CREATE VERTEX person(id UINT PRIMARY KEY, name STRING) +CREATE VERTEX city(id UINT PRIMARY KEY, name STRING) +CREATE GRAPH G1(person, city) +---- + +Suppose a GraphStudio user needs to access only the `id` and `name` attributes of the `person` vertex type in graph `G1`. Grant the `READ_DATA` privilege on the `id` and `name` attributes through the Admin Portal. + To grant an attribute-level privilege: -. Navigate to *User Management* > *User-defined Roles*. +. Navigate to *User Management*. +. Open the *User-defined Roles* tab. . Create a new role or edit an existing role. -. Under *Local privileges*, select the target graph. -. Expand the required vertex or edge type to display its attributes. -. Select the required attribute or attributes. -. Grant the required data privilege (`READ_DATA`, `CREATE_DATA`, or `UPDATE_DATA`). -. Click *Save* to save the role. -. Navigate to *Role Management*. +. Under *Local privileges*, select graph `G1`. +. Expand the `person` vertex type to display its attributes. +. Select the `id` and `name` attributes. +. Grant the `READ_DATA` privilege. +. Save the role. +. Open the *Role Management* tab. . Assign the role to the required user. -After the role is assigned, the user can access only the selected attributes of the vertex or edge type in GraphStudio. +After the role is assigned, the user can access only the selected attributes of the `person` vertex type in GraphStudio. === Edit a user-defined role