Compute
Execute submits queries or jobs to the engine. Abort cancels work on the engine. Manage grants delegates these permissions, including grant-management authority. Compute grants do not provide warehouse data access.
Warehouse
These permissions control data in the organization’s built-in warehouse. Namespace names can be nested, such as
finance.staging.
Warehouse access is enforced by the Iceberg catalog, Lakekeeper. Data grants inherit down the warehouse/namespace hierarchy. Select and Create include Describe; Modify includes Select and Describe. These implications apply to warehouse data access, not to action matching for other oleander resource types.
Attaching warehouse permissions to an assigned role makes them effective in the catalog. Pass grants does not replace oleander’s requirement for Manage grants on both the role and the permission’s resource when changing a role’s permissions.
Reserved table and view scopes
Exact table and view permissions are reserved and cannot currently be created or attached to roles. They are absent from the UI chooser; use namespace permissions instead.
These reserved scopes require exact namespace and object names. There is no all-tables or all-views scope, and Create is not defined on an existing table or view.
Catalogs
These permissions manage Iceberg catalog registrations, including the built-in
oleander catalog and registered external catalogs.
Catalog listing currently requires Describe → All catalogs; a grant for one selected catalog does not authorize the full list. Credential retrieval also requires current organization membership.
Catalog-registration grants do not themselves grant access to its data. The built-in warehouse uses warehouse permissions; external catalogs enforce their own data access. The
oleander catalog cannot be deleted, even by OrganizationAdmin.
Connections
Describe discovers connection registrations. Create registers a connection. Delete removes its registration, not the external database. Manage grants delegates these permissions.
There is no Modify action or single scope covering all connection types. Connection discovery does not grant permissions inside the external database or blanket access to stored passwords. Importing data also requires the appropriate compute and destination-data permissions.
Principals
Use the appropriate type-specific scope for Invite, Remove, Create, and Delete. All principals and Self (whoever holds this role) do not support those lifecycle actions. Principal permissions do not grant access to the principal’s API keys.
API keys
The Scope field selects key owners. In this category, Selected resources selects principals and applies to all their keys; it does not select individual keys.
An individual key can also be targeted through the API, although the UI chooser does not expose that scope. It supports Describe, Revoke, and Manage grants, but not Create. An individual key must have a selected owner or Self; it cannot be paired with all owners or an entire principal type.
Human keys remain self-service even with broad grants. Application and Agent keys can be managed by authorized callers. Listing an owner’s keys requires Describe for that owner’s key collection; an individual-key grant does not authorize listing all their keys. Legacy keys use separate management rules.
Roles
Describe reads the role and its permissions and assigned principals. Role lists include only roles the caller can describe; viewing a role’s assigned principals does not require separate Describe grants on each principal.
Create creates a role definition. Delete removes an eligible custom role, not its principals or shared permission definitions. Manage grants controls role assignments and permission attachments, subject to the second target check.
System-managed roles cannot be deleted or have their permission composition changed. Roles referenced by principal assignments or invitations cannot be deleted.
Permissions
This resource type controls permission definitions, separately from the resources those definitions grant access to.
Describe reads definitions. Listing all definitions requires Describe → All permissions. Create stores a valid permission; it does not attach it to a role. Delete removes an unused custom definition. System-managed definitions and definitions attached to roles cannot be deleted.
Manage grants delegates authority over a permission definition. It does not authorize attaching that definition’s compute, warehouse, or other underlying grant to a role; that requires Manage grants on both the role and the underlying resource.