A role is a container object that can be used to package a collection of privileges. Use of the role is then granted to each user that requires those privileges. A role can also be granted to a list of users.

The role must exist before privileges can be granted to it. See CREATE ROLE for the syntax and rules. The role is maintained by granting privileges to it and, when required, revoking privileges from it. When a role is dropped (see DROP ROLE), all users lose the privileges acquired through the role. Any privileges that were granted additionally to an affected user by way of a different grant statement are retained.

A user that is granted a role must supply that role with his login credentials in order to exercise the associated privileges. Any other privileges granted to the user are not affected by logging in with a role.

More than one role can be granted to the same user but logging in with multiple roles simultaneously is not supported.

A role can be granted only to a user.

Firebird has a predefined user named PUBLIC, that represents all users. Privileges for operations on a particular object that are granted to the user PUBLIC can be exercised by any authenticated user.

The non-standard AS clause is supported as a synonym of the GRANTED BY clause to simplify migration from other database systems.

1. SELECT and INSERT privileges to the user ALEX:

     |GRANT SELECT, INSERT ON TABLE SALES
     |  TO USER ALEX;
   

2. The SELECT privilege to the MANAGER, ENGINEER roles and to the user IVAN:

     |GRANT SELECT ON TABLE CUSTOMER
     |  TO ROLE MANAGER, ROLE ENGINEER, USER IVAN;
   

3. All privileges to the ADMINISTRATOR role, together with the authority to grant the same privileges to others:

     |GRANT ALL ON TABLE CUSTOMER
     |  TO ROLE ADMINISTRATOR
     |  WITH GRANT OPTION;
   

4. The SELECT and REFERENCES privileges on the NAME column to all users and objects:

     |GRANT SELECT, REFERENCES (NAME) ON TABLE COUNTRY
     |TO PUBLIC;
   

5. The SELECT privilege being granted to the user IVAN by the user ALEX:

     |GRANT SELECT ON TABLE EMPLOYEE
     |  TO USER IVAN
     |  GRANTED BY ALEX;
   

6. Granting the UPDATE privilege on the FIRST_NAME, LAST_NAME columns:

     |GRANT UPDATE (FIRST_NAME, LAST_NAME) ON TABLE EMPLOYEE
     |  TO USER IVAN;
   

7. Granting the INSERT privilege to the stored procedure ADD_EMP_PROJ:

     |GRANT INSERT ON EMPLOYEE_PROJECT
     |  TO PROCEDURE ADD_EMP_PROJ;
   

1. Granting the EXECUTE privilege on a stored procedure to a role:

     |GRANT EXECUTE ON PROCEDURE ADD_EMP_PROJ
     |  TO ROLE MANAGER;
   

2. Granting the EXECUTE privilege on a stored function to a role:

     |GRANT EXECUTE ON FUNCTION GET_BEGIN_DATE
     |  TO ROLE MANAGER;
   

3. Granting the EXECUTE privilege on a package to user PUBLIC:

     |GRANT EXECUTE ON PACKAGE APP_VAR
     |  TO USER PUBLIC;
   

4. Granting the EXECUTE privilege on a function to a package:

     |GRANT EXECUTE ON FUNCTION GET_BEGIN_DATE
     |  TO PACKAGE APP_VAR;
   

1. Granting the USAGE privilege on a sequence to a role:

     |GRANT USAGE ON SEQUENCE GEN_AGE
     |  TO ROLE MANAGER;
   

2. Granting the USAGE privilege on a sequence to a trigger:

     |GRANT USAGE ON SEQUENCE GEN_AGE
     |  TO TRIGGER TR_AGE_BI;
   

3. Granting the USAGE privilege on an exception to a package:

     |GRANT USAGE ON EXCEPTION
     |  TO PACKAGE PKG_BILL;
   

1. Allow user JOE to create tables

     |GRANT CREATE TABLE
     |  TO USER Joe;
   

2. Allow user JOE to alter any procedure

     |GRANT ALTER ANY PROCEDURE
     |  TO USER Joe;
   

The optional WITH ADMIN OPTION clause allows the users specified in the user list to grant the role(s) specified to other users.

1. Assigning the DIRECTOR and MANAGER roles to the user IVAN:

     |GRANT DIRECTOR, MANAGER
     |  TO USER IVAN;
   

2. Assigning the MANAGER role to the user ALEX with the authority to assign this role to other users:

     |GRANT MANAGER
     |  TO USER ALEX WITH ADMIN OPTION;
   

See alsoREVOKE