AI Function Service Privileges

This topic describes the privileges for AI function services, including the AI MODEL and ACCESS AI MODEL privileges from the old API, and the AI PROVIDER privilege from the new API.

AI MODEL

AI MODEL-related privileges are used to manage AI models, including the CREATE AI MODEL, ALTER AI MODEL, and DROP AI MODEL privileges.

Syntax

The syntax for granting privileges is as follows:

-- Grant the permission to create AI models.
GRANT CREATE AI MODEL ON *.* TO 'username'@'host';

-- Grant the permission to modify AI models.
GRANT ALTER AI MODEL ON *.* TO 'username'@'host';

-- Grant DeleteAIModel Privilege
GRANT DROP AI MODEL ON *.* TO 'username'@'host';

GRANT CREATE AI MODEL, ALTER AI MODEL, DROP AI MODEL ON *.* TO 'username'@'host';

The syntax for revoking privileges is as follows:

-- Revoke the permission to create AI models
REVOKE CREATE AI MODEL ON *.* FROM 'username'@'host';

-- Revoke AI Model Permission Modification
REVOKE ALTER AI MODEL ON *.* FROM 'username'@'host';

-- Revoke Delete AI Model Permission
REVOKE DROP AI MODEL ON *.* FROM 'username'@'host';

-- Check Permissions
SHOW GRANTS FOR 'username'@'host';

Example

1. Create a user.

   CREATE USER test_ai_user@'%' IDENTIFIED BY '123456';
   

2. Log in to the test_ai_user account.

   obclient -h 127.0.0.1 -P 2881 -u test_ai_user@'%' -p *** -A -D test;
   

3. Call the CREATE_AI_MODEL_ENDPOINT program.

   CALL DBMS_AI_SERVICE.CREATE_AI_MODEL_ENDPOINT (
          'user_ai_model_endpoint_1', '{
            "ai_model_name": "my_model1",
            "url": "https://api.deepseek.com",
            "access_key": "sk-xxxxxxxxxxxx",
            "request_model_name": "deepseek-chat",
            "provider": "deepseek"
          }');
   

   An error is returned because the CREATE AI MODEL privilege is missing.

   ERROR 42501: Access denied; you need (at least one of) the create ai model endpoint privilege(s) for this operation
   

4. Grant the CREATE AI MODEL privilege to the test_ai_user account.

   GRANT CREATE AI MODEL ON *.* TO test_ai_user@'%';
   

5. Verify the permission

   CALL DBMS_AI_SERVICE.CREATE_AI_MODEL_ENDPOINT (
          'user_ai_model_endpoint_1', '{
            "ai_model_name": "my_model1",
            "url": "https://https://api.deepseek.com",
            "access_key": "sk-xxxxxxxxxxxx",
            "request_model_name": "deepseek-caht",
            "provider": "deepseek"
          }');
   

   The operation succeeded.

ACCESS AI MODEL

The ACCESS AI MODEL privilege is used to call AI functions, including AI_COMPLETE, AI_EMBED, AI_RERANK, and AI_PROMPT.

Syntax

The syntax for granting the privilege is as follows:

GRANT ACCESS AI MODEL ON *.* TO 'username'@'host';

The syntax for revoking the privilege is as follows:

REVOKE ACCESS AI MODEL ON *.* FROM 'username'@'host';

Examples

1. Call the AI_COMPLETE function

   SELECT AI_COMPLETE("ob_complete","You are a translation master. Please translate the following text into English: {{Hello World.}}. The output should only contain the translation result") as ans;
   

   An error is returned because the ACCESS AI MODEL privilege is not granted.

   ERROR 42501: Access denied; you need (at least one of) the access ai model endpoint privilege(s) for this operation
   

2. Grant the ACCESS AI MODEL privilege to the test_ai_user user

   GRANT ACCESS AI MODEL ON *.* TO test_ai_user@'%';
   

3. Verify the permission

   SELECT AI_COMPLETE("ob_complete","You are a translation master. Please translate the following text into English: {{Hello World.}}. The output should only contain the translation result") as ans;
   

   The operation succeeds.

   +----------------+
   | ans            |
   +----------------+
   | "Hello world." |
   +----------------+
   1 row in set
   

AI PROVIDER

The AI PROVIDER privilege is used to manage provider configurations and model parameters at the provider/model level. It is granted or revoked by the root user.

Syntax

The syntax for granting the privilege is as follows:

-- Grant the REGISTER_PROVIDER privilege.
GRANT REGISTER ON AI PROVIDER * TO 'username'@'host';

-- Grant the privilege to modify provider information, corresponding to ALTER_MODEL_PROFILE.
GRANT ALTER ON AI PROVIDER * TO 'username'@'host';

-- GRANT/REVOKE MODEL PROFILE, corresponding to DROP_MODEL_PROFILE
GRANT UNREGISTER ON AI PROVIDER * TO 'username'@'host';

-- Grant model access permissions
GRANT ACCESS ON AI PROVIDER * TO 'username'@'host';

The syntax for revoking the privilege is as follows:

-- Revoke the provider registration privilege
REVOKE REGISTER ON AI PROVIDER * FROM 'username'@'host';

-- Revoke the provider modification privilege
REVOKE ALTER ON AI PROVIDER * FROM 'username'@'host';

-- Revoke the provider unregistration privilege
REVOKE UNREGISTER ON AI PROVIDER * FROM 'username'@'host';

-- Revoke Model Access Permissions
REVOKE ACCESS ON AI PROVIDER * FROM 'username'@'host';

After granting the AI PROVIDER privilege to a user, it takes effect on all models within the tenant.

References

• Register AI models