{
    "name": "GRANT(7)",
    "mode": "man",
    "parameter": "GRANT",
    "section": "7",
    "url": "/phpMan.php/man/GRANT/7/json",
    "generated": "2026-05-27T16:09:57Z",
    "synopsis": "GRANT { { SELECT | INSERT | UPDATE | DELETE | TRUNCATE | REFERENCES | TRIGGER }\n[, ...] | ALL [ PRIVILEGES ] }\nON { [ TABLE ] tablename [, ...]\n| ALL TABLES IN SCHEMA schemaname [, ...] }\nTO rolespecification [, ...] [ WITH GRANT OPTION ]\n[ GRANTED BY rolespecification ]\nGRANT { { SELECT | INSERT | UPDATE | REFERENCES } ( columnname [, ...] )\n[, ...] | ALL [ PRIVILEGES ] ( columnname [, ...] ) }\nON [ TABLE ] tablename [, ...]\nTO rolespecification [, ...] [ WITH GRANT OPTION ]\n[ GRANTED BY rolespecification ]\nGRANT { { USAGE | SELECT | UPDATE }\n[, ...] | ALL [ PRIVILEGES ] }\nON { SEQUENCE sequencename [, ...]\n| ALL SEQUENCES IN SCHEMA schemaname [, ...] }\nTO rolespecification [, ...] [ WITH GRANT OPTION ]\n[ GRANTED BY rolespecification ]\nGRANT { { CREATE | CONNECT | TEMPORARY | TEMP } [, ...] | ALL [ PRIVILEGES ] }\nON DATABASE databasename [, ...]\nTO rolespecification [, ...] [ WITH GRANT OPTION ]\n[ GRANTED BY rolespecification ]\nGRANT { USAGE | ALL [ PRIVILEGES ] }\nON DOMAIN domainname [, ...]\nTO rolespecification [, ...] [ WITH GRANT OPTION ]\n[ GRANTED BY rolespecification ]\nGRANT { USAGE | ALL [ PRIVILEGES ] }\nON FOREIGN DATA WRAPPER fdwname [, ...]\nTO rolespecification [, ...] [ WITH GRANT OPTION ]\n[ GRANTED BY rolespecification ]\nGRANT { USAGE | ALL [ PRIVILEGES ] }\nON FOREIGN SERVER servername [, ...]\nTO rolespecification [, ...] [ WITH GRANT OPTION ]\n[ GRANTED BY rolespecification ]\nGRANT { EXECUTE | ALL [ PRIVILEGES ] }\nON { { FUNCTION | PROCEDURE | ROUTINE } routinename [ ( [ [ argmode ] [ argname ] argtype [, ...] ] ) ] [, ...]\n| ALL { FUNCTIONS | PROCEDURES | ROUTINES } IN SCHEMA schemaname [, ...] }\nTO rolespecification [, ...] [ WITH GRANT OPTION ]\n[ GRANTED BY rolespecification ]\nGRANT { USAGE | ALL [ PRIVILEGES ] }\nON LANGUAGE langname [, ...]\nTO rolespecification [, ...] [ WITH GRANT OPTION ]\n[ GRANTED BY rolespecification ]\nGRANT { { SELECT | UPDATE } [, ...] | ALL [ PRIVILEGES ] }\nON LARGE OBJECT loid [, ...]\nTO rolespecification [, ...] [ WITH GRANT OPTION ]\n[ GRANTED BY rolespecification ]\nGRANT { { CREATE | USAGE } [, ...] | ALL [ PRIVILEGES ] }\nON SCHEMA schemaname [, ...]\nTO rolespecification [, ...] [ WITH GRANT OPTION ]\n[ GRANTED BY rolespecification ]\nGRANT { CREATE | ALL [ PRIVILEGES ] }\nON TABLESPACE tablespacename [, ...]\nTO rolespecification [, ...] [ WITH GRANT OPTION ]\n[ GRANTED BY rolespecification ]\nGRANT { USAGE | ALL [ PRIVILEGES ] }\nON TYPE typename [, ...]\nTO rolespecification [, ...] [ WITH GRANT OPTION ]\n[ GRANTED BY rolespecification ]\nGRANT rolename [, ...] TO rolespecification [, ...]\n[ WITH ADMIN OPTION ]\n[ GRANTED BY rolespecification ]\nwhere rolespecification can be:\n[ GROUP ] rolename\n| PUBLIC\n| CURRENTROLE\n| CURRENTUSER\n| SESSIONUSER",
    "sections": [
        {
            "name": "NAME",
            "level": 1,
            "content": "GRANT - define access privileges\n",
            "subsections": []
        },
        {
            "name": "SYNOPSIS",
            "level": 1,
            "content": "GRANT { { SELECT | INSERT | UPDATE | DELETE | TRUNCATE | REFERENCES | TRIGGER }\n[, ...] | ALL [ PRIVILEGES ] }\nON { [ TABLE ] tablename [, ...]\n| ALL TABLES IN SCHEMA schemaname [, ...] }\nTO rolespecification [, ...] [ WITH GRANT OPTION ]\n[ GRANTED BY rolespecification ]\n\nGRANT { { SELECT | INSERT | UPDATE | REFERENCES } ( columnname [, ...] )\n[, ...] | ALL [ PRIVILEGES ] ( columnname [, ...] ) }\nON [ TABLE ] tablename [, ...]\nTO rolespecification [, ...] [ WITH GRANT OPTION ]\n[ GRANTED BY rolespecification ]\n\nGRANT { { USAGE | SELECT | UPDATE }\n[, ...] | ALL [ PRIVILEGES ] }\nON { SEQUENCE sequencename [, ...]\n| ALL SEQUENCES IN SCHEMA schemaname [, ...] }\nTO rolespecification [, ...] [ WITH GRANT OPTION ]\n[ GRANTED BY rolespecification ]\n\nGRANT { { CREATE | CONNECT | TEMPORARY | TEMP } [, ...] | ALL [ PRIVILEGES ] }\nON DATABASE databasename [, ...]\nTO rolespecification [, ...] [ WITH GRANT OPTION ]\n[ GRANTED BY rolespecification ]\n\nGRANT { USAGE | ALL [ PRIVILEGES ] }\nON DOMAIN domainname [, ...]\nTO rolespecification [, ...] [ WITH GRANT OPTION ]\n[ GRANTED BY rolespecification ]\n\nGRANT { USAGE | ALL [ PRIVILEGES ] }\nON FOREIGN DATA WRAPPER fdwname [, ...]\nTO rolespecification [, ...] [ WITH GRANT OPTION ]\n[ GRANTED BY rolespecification ]\n\nGRANT { USAGE | ALL [ PRIVILEGES ] }\nON FOREIGN SERVER servername [, ...]\nTO rolespecification [, ...] [ WITH GRANT OPTION ]\n[ GRANTED BY rolespecification ]\n\nGRANT { EXECUTE | ALL [ PRIVILEGES ] }\nON { { FUNCTION | PROCEDURE | ROUTINE } routinename [ ( [ [ argmode ] [ argname ] argtype [, ...] ] ) ] [, ...]\n| ALL { FUNCTIONS | PROCEDURES | ROUTINES } IN SCHEMA schemaname [, ...] }\nTO rolespecification [, ...] [ WITH GRANT OPTION ]\n[ GRANTED BY rolespecification ]\n\nGRANT { USAGE | ALL [ PRIVILEGES ] }\nON LANGUAGE langname [, ...]\nTO rolespecification [, ...] [ WITH GRANT OPTION ]\n[ GRANTED BY rolespecification ]\n\nGRANT { { SELECT | UPDATE } [, ...] | ALL [ PRIVILEGES ] }\nON LARGE OBJECT loid [, ...]\nTO rolespecification [, ...] [ WITH GRANT OPTION ]\n[ GRANTED BY rolespecification ]\n\nGRANT { { CREATE | USAGE } [, ...] | ALL [ PRIVILEGES ] }\nON SCHEMA schemaname [, ...]\nTO rolespecification [, ...] [ WITH GRANT OPTION ]\n[ GRANTED BY rolespecification ]\n\nGRANT { CREATE | ALL [ PRIVILEGES ] }\nON TABLESPACE tablespacename [, ...]\nTO rolespecification [, ...] [ WITH GRANT OPTION ]\n[ GRANTED BY rolespecification ]\n\nGRANT { USAGE | ALL [ PRIVILEGES ] }\nON TYPE typename [, ...]\nTO rolespecification [, ...] [ WITH GRANT OPTION ]\n[ GRANTED BY rolespecification ]\n\nGRANT rolename [, ...] TO rolespecification [, ...]\n[ WITH ADMIN OPTION ]\n[ GRANTED BY rolespecification ]\n\nwhere rolespecification can be:\n\n[ GROUP ] rolename\n| PUBLIC\n| CURRENTROLE\n| CURRENTUSER\n| SESSIONUSER\n",
            "subsections": []
        },
        {
            "name": "DESCRIPTION",
            "level": 1,
            "content": "The GRANT command has two basic variants: one that grants privileges on a database object\n(table, column, view, foreign table, sequence, database, foreign-data wrapper, foreign\nserver, function, procedure, procedural language, schema, or tablespace), and one that grants\nmembership in a role. These variants are similar in many ways, but they are different enough\nto be described separately.\n",
            "subsections": [
                {
                    "name": "GRANT on Database Objects",
                    "level": 2,
                    "content": "This variant of the GRANT command gives specific privileges on a database object to one or\nmore roles. These privileges are added to those already granted, if any.\n\nThe key word PUBLIC indicates that the privileges are to be granted to all roles, including\nthose that might be created later.  PUBLIC can be thought of as an implicitly defined group\nthat always includes all roles. Any particular role will have the sum of privileges granted\ndirectly to it, privileges granted to any role it is presently a member of, and privileges\ngranted to PUBLIC.\n\nIf WITH GRANT OPTION is specified, the recipient of the privilege can in turn grant it to\nothers. Without a grant option, the recipient cannot do that. Grant options cannot be granted\nto PUBLIC.\n\nIf GRANTED BY is specified, the specified grantor must be the current user. This clause is\ncurrently present in this form only for SQL compatibility.\n\nThere is no need to grant privileges to the owner of an object (usually the user that created\nit), as the owner has all privileges by default. (The owner could, however, choose to revoke\nsome of their own privileges for safety.)\n\nThe right to drop an object, or to alter its definition in any way, is not treated as a\ngrantable privilege; it is inherent in the owner, and cannot be granted or revoked. (However,\na similar effect can be obtained by granting or revoking membership in the role that owns the\nobject; see below.) The owner implicitly has all grant options for the object, too.\n\nThe possible privileges are:\n\nSELECT\nINSERT\nUPDATE\nDELETE\nTRUNCATE\nREFERENCES\nTRIGGER\nCREATE\nCONNECT\nTEMPORARY\nEXECUTE\nUSAGE\nSpecific types of privileges, as defined in Section 5.7.\n\nTEMP\nAlternative spelling for TEMPORARY.\n\nALL PRIVILEGES\nGrant all of the privileges available for the object's type. The PRIVILEGES key word is\noptional in PostgreSQL, though it is required by strict SQL.\n\nThe FUNCTION syntax works for plain functions, aggregate functions, and window functions, but\nnot for procedures; use PROCEDURE for those. Alternatively, use ROUTINE to refer to a\nfunction, aggregate function, window function, or procedure regardless of its precise type.\n\nThere is also an option to grant privileges on all objects of the same type within one or\nmore schemas. This functionality is currently supported only for tables, sequences,\nfunctions, and procedures.  ALL TABLES also affects views and foreign tables, just like the\nspecific-object GRANT command.  ALL FUNCTIONS also affects aggregate and window functions,\nbut not procedures, again just like the specific-object GRANT command. Use ALL ROUTINES to\ninclude procedures.\n"
                },
                {
                    "name": "GRANT on Roles",
                    "level": 2,
                    "content": "This variant of the GRANT command grants membership in a role to one or more other roles.\nMembership in a role is significant because it conveys the privileges granted to a role to\neach of its members.\n\nIf WITH ADMIN OPTION is specified, the member can in turn grant membership in the role to\nothers, and revoke membership in the role as well. Without the admin option, ordinary users\ncannot do that. A role is not considered to hold WITH ADMIN OPTION on itself, but it may\ngrant or revoke membership in itself from a database session where the session user matches\nthe role. Database superusers can grant or revoke membership in any role to anyone. Roles\nhaving CREATEROLE privilege can grant or revoke membership in any role that is not a\nsuperuser.\n\nIf GRANTED BY is specified, the grant is recorded as having been done by the specified role.\nOnly database superusers may use this option, except when it names the same role executing\nthe command.\n\nUnlike the case with privileges, membership in a role cannot be granted to PUBLIC. Note also\nthat this form of the command does not allow the noise word GROUP in rolespecification.\n"
                }
            ]
        },
        {
            "name": "NOTES",
            "level": 1,
            "content": "The REVOKE command is used to revoke access privileges.\n\nSince PostgreSQL 8.1, the concepts of users and groups have been unified into a single kind\nof entity called a role. It is therefore no longer necessary to use the keyword GROUP to\nidentify whether a grantee is a user or a group.  GROUP is still allowed in the command, but\nit is a noise word.\n\nA user may perform SELECT, INSERT, etc. on a column if they hold that privilege for either\nthe specific column or its whole table. Granting the privilege at the table level and then\nrevoking it for one column will not do what one might wish: the table-level grant is\nunaffected by a column-level operation.\n\nWhen a non-owner of an object attempts to GRANT privileges on the object, the command will\nfail outright if the user has no privileges whatsoever on the object. As long as some\nprivilege is available, the command will proceed, but it will grant only those privileges for\nwhich the user has grant options. The GRANT ALL PRIVILEGES forms will issue a warning message\nif no grant options are held, while the other forms will issue a warning if grant options for\nany of the privileges specifically named in the command are not held. (In principle these\nstatements apply to the object owner as well, but since the owner is always treated as\nholding all grant options, the cases can never occur.)\n\nIt should be noted that database superusers can access all objects regardless of object\nprivilege settings. This is comparable to the rights of root in a Unix system. As with root,\nit's unwise to operate as a superuser except when absolutely necessary.\n\nIf a superuser chooses to issue a GRANT or REVOKE command, the command is performed as though\nit were issued by the owner of the affected object. In particular, privileges granted via\nsuch a command will appear to have been granted by the object owner. (For role membership,\nthe membership appears to have been granted by the containing role itself.)\n\nGRANT and REVOKE can also be done by a role that is not the owner of the affected object, but\nis a member of the role that owns the object, or is a member of a role that holds privileges\nWITH GRANT OPTION on the object. In this case the privileges will be recorded as having been\ngranted by the role that actually owns the object or holds the privileges WITH GRANT OPTION.\nFor example, if table t1 is owned by role g1, of which role u1 is a member, then u1 can grant\nprivileges on t1 to u2, but those privileges will appear to have been granted directly by g1.\nAny other member of role g1 could revoke them later.\n\nIf the role executing GRANT holds the required privileges indirectly via more than one role\nmembership path, it is unspecified which containing role will be recorded as having done the\ngrant. In such cases it is best practice to use SET ROLE to become the specific role you want\nto do the GRANT as.\n\nGranting permission on a table does not automatically extend permissions to any sequences\nused by the table, including sequences tied to SERIAL columns. Permissions on sequences must\nbe set separately.\n\nSee Section 5.7 for more information about specific privilege types, as well as how to\ninspect objects' privileges.\n",
            "subsections": []
        },
        {
            "name": "EXAMPLES",
            "level": 1,
            "content": "Grant insert privilege to all users on table films:\n\nGRANT INSERT ON films TO PUBLIC;\n\nGrant all available privileges to user manuel on view kinds:\n\nGRANT ALL PRIVILEGES ON kinds TO manuel;\n\nNote that while the above will indeed grant all privileges if executed by a superuser or the\nowner of kinds, when executed by someone else it will only grant those permissions for which\nthe someone else has grant options.\n\nGrant membership in role admins to user joe:\n\nGRANT admins TO joe;\n",
            "subsections": []
        },
        {
            "name": "COMPATIBILITY",
            "level": 1,
            "content": "According to the SQL standard, the PRIVILEGES key word in ALL PRIVILEGES is required. The SQL\nstandard does not support setting the privileges on more than one object per command.\n\nPostgreSQL allows an object owner to revoke their own ordinary privileges: for example, a\ntable owner can make the table read-only to themselves by revoking their own INSERT, UPDATE,\nDELETE, and TRUNCATE privileges. This is not possible according to the SQL standard. The\nreason is that PostgreSQL treats the owner's privileges as having been granted by the owner\nto themselves; therefore they can revoke them too. In the SQL standard, the owner's\nprivileges are granted by an assumed entity “SYSTEM”. Not being “SYSTEM”, the owner cannot\nrevoke these rights.\n\nAccording to the SQL standard, grant options can be granted to PUBLIC; PostgreSQL only\nsupports granting grant options to roles.\n\nThe SQL standard allows the GRANTED BY option to specify only CURRENTUSER or CURRENTROLE.\nThe other variants are PostgreSQL extensions.\n\nThe SQL standard provides for a USAGE privilege on other kinds of objects: character sets,\ncollations, translations.\n\nIn the SQL standard, sequences only have a USAGE privilege, which controls the use of the\nNEXT VALUE FOR expression, which is equivalent to the function nextval in PostgreSQL. The\nsequence privileges SELECT and UPDATE are PostgreSQL extensions. The application of the\nsequence USAGE privilege to the currval function is also a PostgreSQL extension (as is the\nfunction itself).\n\nPrivileges on databases, tablespaces, schemas, and languages are PostgreSQL extensions.\n",
            "subsections": [
                {
                    "name": "SEE ALSO",
                    "level": 2,
                    "content": "REVOKE(7), ALTER DEFAULT PRIVILEGES (ALTERDEFAULTPRIVILEGES(7))\n\n\n"
                }
            ]
        },
        {
            "name": "PostgreSQL 14.23                                2026                                        GRANT(7)",
            "level": 1,
            "content": "",
            "subsections": []
        }
    ]
}