> ## Documentation Index > Fetch the complete documentation index at: https://docs.oleander.dev/llms.txt > Use this file to discover all available pages before exploring further. # Resources and actions > The complete reference for resource types, scopes, and permission actions. These tables use the **Resource type**, **Scope**, and **Actions** labels from the role permission editor. All scopes belong to the current organization. Broad scopes include matching future resources; selected scopes apply to the chosen objects. Only **Allow** permissions are supported. An action listed here is a valid permission definition; limitations below identify operations that are not implemented. See [Permissions](/iam/permissions) for assignment and delegation rules. ## Compute | Resource type | Scope | Actions | | ------------- | ----------------------------------------------------------- | ----------------------------- | | Compute | All engines | Execute, Abort, Manage grants | | Compute | Selected resources: `spark`, `duckdb`, `bloom`, or `polars` | Execute, Abort, Manage grants | **Execute** submits queries or jobs to the engine. **Abort** cancels work on the engine. **Manage grants** delegates these permissions, including grant-management authority. Compute grants do not provide warehouse data access. ## Warehouse | Resource type | Scope | Actions | | ------------- | ------------------- | ------------------------------------------------------------ | | Warehouse | Entire warehouse | Describe, Select, Create, Modify, Manage grants, Pass grants | | Warehouse | Selected namespaces | Describe, Select, Create, Modify, Manage grants, Pass grants | These permissions control data in the organization's built-in warehouse. Namespace names can be nested, such as `finance.staging`. | Action | Meaning within the scope | | ------------- | ----------------------------------------------------------- | | Describe | Discover objects and read their metadata. | | Select | Read table and view data. | | Create | Create child namespaces, tables, and views. | | Modify | Change object contents or properties. | | Manage grants | Administer grants, including Manage grants and Pass grants. | | Pass grants | Delegate held privileges, but not Pass grants itself. | Warehouse access is enforced by the Iceberg catalog, Lakekeeper. Data grants inherit down the warehouse/namespace hierarchy. **Select** and **Create** include **Describe**; **Modify** includes **Select** and **Describe**. These implications apply to warehouse data access, not to action matching for other oleander resource types. Attaching warehouse permissions to an assigned role makes them effective in the catalog. **Pass grants** does not replace oleander's requirement for **Manage grants** on both the role and the permission's resource when changing a role's permissions. ### Reserved table and view scopes Exact table and view permissions are reserved and cannot currently be created or attached to roles. They are absent from the UI chooser; use namespace permissions instead. | Resource type | Reserved scope | Defined actions | | --------------- | -------------------------------------- | ---------------------------------------------------- | | Warehouse table | One named table in one named namespace | Describe, Select, Modify, Manage grants, Pass grants | | Warehouse view | One named view in one named namespace | Describe, Select, Modify, Manage grants, Pass grants | These reserved scopes require exact namespace and object names. There is no all-tables or all-views scope, and Create is not defined on an existing table or view. ## Catalogs | Resource type | Scope | Actions | | ------------- | ------------------ | ----------------------------------------------- | | Catalogs | All catalogs | Describe, Create, Modify, Delete, Manage grants | | Catalogs | Selected resources | Describe, Modify, Delete, Manage grants | These permissions manage Iceberg catalog registrations, including the built-in `oleander` catalog and registered external catalogs. | Action | Meaning | | ------------- | ---------------------------------------------------------- | | Describe | View catalog information and retrieve catalog credentials. | | Create | Register a catalog. | | Modify | Update a catalog's registration configuration. | | Delete | Remove a registration, not its warehouse data. | | Manage grants | Delegate catalog-registration permissions. | Catalog listing currently requires **Describe → All catalogs**; a grant for one selected catalog does not authorize the full list. Credential retrieval also requires current organization membership. Catalog-registration grants do not themselves grant access to its data. The built-in warehouse uses warehouse permissions; external catalogs enforce their own data access. The `oleander` catalog cannot be deleted, even by **OrganizationAdmin**. ## Connections | Resource type | Scope | Actions | | --------------------- | ------------------------- | --------------------------------------- | | Postgres connections | All Postgres connections | Describe, Create, Delete, Manage grants | | Postgres connections | Selected resources | Describe, Delete, Manage grants | | BigQuery connections | All BigQuery connections | Describe, Create, Delete, Manage grants | | BigQuery connections | Selected resources | Describe, Delete, Manage grants | | Snowflake connections | All Snowflake connections | Describe, Create, Delete, Manage grants | | Snowflake connections | Selected resources | Describe, Delete, Manage grants | **Describe** discovers connection registrations. **Create** registers a connection. **Delete** removes its registration, not the external database. **Manage grants** delegates these permissions. There is no Modify action or single scope covering all connection types. Connection discovery does not grant permissions inside the external database or blanket access to stored passwords. Importing data also requires the appropriate compute and destination-data permissions. ## Principals | Resource type | Scope | Actions | | ------------- | ------------------------------------------ | ---------------------------------------------------------------- | | Principals | All principals | Describe, Modify, Enable, Disable, Manage grants | | Principals | Self (whoever holds this role) | Describe, Modify, Enable, Disable, Manage grants | | Principals | All human principals | Describe, Modify, Enable, Disable, Manage grants, Invite, Remove | | Principals | Selected resources: Human principals | Describe, Modify, Enable, Disable, Manage grants, Remove | | Principals | All application principals | Describe, Modify, Enable, Disable, Manage grants, Create, Delete | | Principals | Selected resources: Application principals | Describe, Modify, Enable, Disable, Manage grants, Delete | | Principals | All agent principals | Describe, Modify, Enable, Disable, Manage grants, Create, Delete | | Principals | Selected resources: Agent principals | Describe, Modify, Enable, Disable, Manage grants, Delete | | Action | Meaning | | ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Describe | View principal information. Principal lists include only principals the caller can describe. | | Modify | Defined for editing principal details; the operation is not implemented yet. | | Enable / Disable | Defined for activation changes; the operations are not implemented yet. | | Manage grants | Manage role assignments, also requiring Manage grants on the role. Separate Describe and Manage grants checks apply when delegating execution to a principal. | | Invite | Invite a Human to the organization; roles on the invitation also require Manage grants on each role. | | Remove | Remove a Human's organization membership, preserving their account. | | Create | Create an Application or Agent principal. | | Delete | Delete an Application or Agent principal. System-managed principals are protected. | Use the appropriate type-specific scope for Invite, Remove, Create, and Delete. **All principals** and **Self (whoever holds this role)** do not support those lifecycle actions. Principal permissions do not grant access to the principal's API keys. ## API keys The Scope field selects **key owners**. In this category, **Selected resources** selects principals and applies to all their keys; it does not select individual keys. | Resource type | Scope | Actions | | ------------- | ------------------------------------ | --------------------------------------- | | API keys | All principals | Describe, Create, Revoke, Manage grants | | API keys | Self (whoever holds this role) | Describe, Create, Revoke, Manage grants | | API keys | All human principals | Describe, Create, Revoke, Manage grants | | API keys | All application principals | Describe, Create, Revoke, Manage grants | | API keys | All agent principals | Describe, Create, Revoke, Manage grants | | API keys | Selected resources: principal owners | Describe, Create, Revoke, Manage grants | An individual key can also be targeted through the API, although the UI chooser does not expose that scope. It supports **Describe**, **Revoke**, and **Manage grants**, but not **Create**. An individual key must have a selected owner or Self; it cannot be paired with all owners or an entire principal type. | Action | Meaning | | ------------- | --------------------------------------------------------------------------------------- | | Describe | List an owner's keys, including their stored values. Treat this as credential access. | | Create | Issue a key owned by the selected principal. | | Revoke | Revoke a key owned by the selected principal. | | Manage grants | Delegate key-management permissions; does not itself grant Describe, Create, or Revoke. | Human keys remain self-service even with broad grants. Application and Agent keys can be managed by authorized callers. Listing an owner's keys requires Describe for that owner's key collection; an individual-key grant does not authorize listing all their keys. [Legacy keys](/platform/settings/api-keys#legacy-keys) use separate management rules. ## Roles | Resource type | Scope | Actions | | ------------- | ------------------ | --------------------------------------- | | Roles | All roles | Describe, Create, Delete, Manage grants | | Roles | Selected resources | Describe, Delete, Manage grants | **Describe** reads the role and its permissions and assigned principals. Role lists include only roles the caller can describe; viewing a role's assigned principals does not require separate Describe grants on each principal. **Create** creates a role definition. **Delete** removes an eligible custom role, not its principals or shared permission definitions. **Manage grants** controls role assignments and permission attachments, subject to the [second target check](/iam/permissions#delegating-access). [System-managed roles](/iam/roles#system-managed-roles) cannot be deleted or have their permission composition changed. Roles referenced by principal assignments or invitations cannot be deleted. ## Permissions | Resource type | Scope | Actions | | ------------- | ------------------ | --------------------------------------- | | Permissions | All permissions | Describe, Create, Delete, Manage grants | | Permissions | Selected resources | Describe, Delete, Manage grants | This resource type controls **permission definitions**, separately from the resources those definitions grant access to. **Describe** reads definitions. Listing all definitions requires **Describe → All permissions**. **Create** stores a valid permission; it does not attach it to a role. **Delete** removes an unused custom definition. System-managed definitions and definitions attached to roles cannot be deleted. **Manage grants** delegates authority over a permission definition. It does not authorize attaching that definition's compute, warehouse, or other underlying grant to a role; that requires Manage grants on both the role and the underlying resource.