Account privileges|OceanBase Cloud | docs|Distributed Database

Account privileges

Last Updated：2026-04-08 05:58:26 Updated

This topic describes the privileges of common accounts for different types of instances in OceanBase Cloud.

Global privileges

Privilege	Description
CREATE	Execute the CREATE DATABASE, CREATE TABLEGROUP, CREATE TABLE, CREATE SEQUENCE, and CREATE OUTLINE statements.
ALTER	Execute the ALTER DATABASE, ALTER TABLEGROUP, RENAME TABLE, ALTER TABLE, ALTER SEQUENCE, and ALTER OUTLINE statements.
SELECT	Query data in a table.
INSERT	Insert rows of data into a table.
UPDATE	Modify existing data.
DELETE	Delete existing data.
DROP	Execute the DROP DATABASE, DROP TABLEGROUP, DROP TABLE, DROP VIEW, DROP SEQUENCE, and DROP OUTLINE statements.
INDEX	Create and drop table indexes.
CREATE VIEW	Create a view.
SHOW VIEW	View a view or understand how a view executes.
REFERENCES	Create a foreign key.
ALTER SYSTEM	Execute the ALTER SYSTEM statement.
CREATE DATABASE LINK	Create a database link.
DROP DATABASE LINK	Drop a database link.
CREATE USER	Execute the CREATE USER, ALTER USER, DROP USER, CREATE ROLE, and DROP ROLE statements.
CREATE ROUTINE	Create a procedure or a function.
ALTER ROUTINE	Modify or drop a procedure or a function.
CREATE TABLESPACE	Execute the CREATE TABLESPACE, ALTER TABLESPACE, and DROP TABLESPACE statements.
CREATE ROLE	Execute the CREATE ROLE statement.
DROP ROLE	Execute the DROP ROLE statement.
EXECUTE	Execute a procedure or a function.
PROCESS	View processes of other users by using the SHOW PROCESSLIST statement.
TRIGGER	The privilege to activate trigger operations. You must have this privilege when you create, view, or drop a trigger.
SHOW DATABASES	View the names of all databases on the server, including those to which you have sufficient access privileges.
FILE	Execute the SELECT INTO OUTFILE and LOAD DATA INFILE statements.
SUPER	Execute some powerful management features, such as deleting user processes by using the KILL statement, modifying global MySQL variables by using SET GLOBAL, and executing various commands related to replication and logs.
CREATE LOCATION	Execute the CREATE LOCATION, ALTER LOCATION, and DROP LOCATION statements.
CREATE CATALOG	Execute the CREATE EXTERNAL CATALOG and DROP CATALOG statements.
USE CATALOG	Execute the SET CATALOG, SHOW CATALOGS, SHOW CREATE CATALOG, and SELECT FROM CATALOG statements.
LOCK TABLES	Add table locks in a session.
EVENT	Enable scheduled SQL tasks.
ENCRYPT	Encrypt RAW data by using a stream cipher or a block cipher.
DECRYPT	Decrypt RAW data by using a stream cipher or a block cipher.
CREATE AI MODEL	Create an AI model used by an SQL AI function.
DROP AI MODEL	Drop an AI model used by an SQL AI function.
ALTER AI MODEL	Modify an AI model used by an SQL AI function.
ACCESS AI MODEL	Call an SQL AI function to use an AI model.

Database privileges

Transactional instances

Analytic instance

Key-Value instance

Account privileges in MySQL-compatible tenants

The default privileges of a normal account in MySQL-compatible tenants are SELECT on information_schema.*.

Privilege type	Privilege	Description
Read/Write	ALL PRIVILEGES	All privileges except `GRANT OPTION`.
Read Only	CREATE SESSION	The privilege to connect to a database.
Read Only	SELECT	The privilege to query data in a table.
Read Only	SHOW VIEW	The privilege to view a view or understand how it executes.
DDL Only	CREATE	The privilege to create a table.
DDL Only	DROP	The privilege to drop tables and views.
DDL Only	ALTER	The privilege to rename and modify table structures.
DDL Only	SHOW VIEW	The privilege to view a view or understand how it executes.
DDL Only	CREATE VIEW	The privilege to create a view.
DML Only	SELECT	The privilege to query data in a table.
DML Only	INSERT	The privilege to insert rows into a table.
DML Only	UPDATE	The privilege to modify existing data.
DML Only	DELETE	The privilege to delete existing data.
DML Only	SHOW VIEW	The privilege to view a view or understand how it executes.
DML Only	PROCESS	The privilege to view other users' processes by using the `SHOW PROCESSLIST` command.

Account privileges in Oracle-compatible tenants

The default privileges for a normal account in an Oracle-compatible tenant are as follows:

Privilege	Description
CREATE TABLE	Privilege to create tables.
CREATE VIEW	Privilege to create views.
CREATE PROCEDURE	Privilege to create any stored procedure for the user.
CREATE SYNONYM	Privilege to create synonyms for the user.
CREATE SEQUENCE	Privilege to create sequences for the user.
CREATE TRIGGER	Privilege to create triggers for the user.
CREATE TYPE	Privilege to create types.
CREATE SESSION	Privilege to create sessions.
EXECUTE ANY PROCEDURE	Privilege to execute any stored procedure.
CREATE ANY OUTLINE	Privilege to create any execution plan.
ALTER ANY OUTLINE	Privilege to modify any execution plan.
DROP ANY OUTLINE	Privilege to drop any execution plan.
CREATE ANY PROCEDURE	Privilege to create any stored procedure for the user.
ALTER ANY PROCEDURE	Privilege to modify any stored procedure.
DROP ANY PROCEDURE	Privilege to drop any stored procedure.
CREATE ANY SEQUENCE	Privilege to create any sequence.
ALTER ANY SEQUENCE	Privilege to modify any sequence.
DROP ANY SEQUENCE	Privilege to drop any sequence.
CREATE ANY TYPE	Privilege to create any type.
ALTER ANY TYPE	Privilege to modify any type.
DROP ANY TYPE	Privilege to drop any type.
SYSKM	`SYSKM` privilege, which allows you to perform operations related to transparent data encryption (TDE).
CREATE ANY TRIGGER	Privilege to create any trigger for the user.
ALTER ANY TRIGGER	Privilege to modify any trigger.
DROP ANY TRIGGER	Privilege to drop any trigger.
CREATE PROFILE	Privilege to create a resource limit profile.
ALTER PROFILE	Privilege to modify a resource limit profile.
DROP PROFILE	Privilege to drop a resource limit profile.

Privilege type	Privilege	Description
Read/Write	ALL PRIVILEGES	All privileges except for `GRANT OPTION`.
Read-only	CREATE SESSION	Privilege to connect to the database.
Read-only	SELECT	Privilege to query data in a table.
Read-only	SHOW VIEW	Privilege to view a view or understand how it executes.
DDL only	CREATE	Privilege to create tables.
DDL only	DROP	Privilege to drop tables and views.
DDL only	ALTER	Privilege to rename and modify table structures.
DDL only	SHOW VIEW	Privilege to view a view or understand how it executes.
DDL only	CREATE VIEW	Privilege to create views.
DML only	SELECT	Privilege to query data in a table.
DML only	INSERT	Privilege to insert rows into a table.
DML only	UPDATE	Privilege to modify existing data.
DML only	DELETE	Privilege to delete existing data.
DML only	SHOW VIEW	Privilege to view a view or understand how it executes.
DML only	PROCESS	Privilege to view other users' processes by using the `SHOW PROCESSLIST` command.

Account privileges in HBase-compatible tenants

Privilege type	Privilege	Description
Read-only	SELECT	Privilege to query data in the table.
Read and write	ALL PRIVILEGES	All privileges except for `GRANT OPTION` and view-related privileges.
DDL only	CREATE	Privilege to create tables.
DDL only	ALTER	Privilege to rename and modify table structures.
DML only	SELECT	Privilege to query data in the table.
DML only	INSERT	Privilege to insert rows into the table.
DML only	UPDATE	Privilege to modify existing data.
DML only	DELETE	Privilege to delete existing data.

Account privileges in Table-compatible tenants

Privilege type	Privilege	Description
Read-only	SELECT	Privilege to query data in the table.
Read and write	ALL PRIVILEGES	All privileges except for `GRANT OPTION` and view-related privileges.
DDL only	CREATE	Privilege to create tables.
DDL only	ALTER	Privilege to rename and modify table structures.
DML only	SELECT	Privilege to query data in the table.
DML only	INSERT	Privilege to insert rows into the table.
DML only	UPDATE	Privilege to modify existing data.
DML only	DELETE	Privilege to delete existing data.

OceanBase

Customer Stories

Documentation