Role-based access controlAuraDB Business CriticalAuraDB Virtual Dedicated CloudEnterprise Edition
Role-based access control (RBAC) is a secure method for granting users access by defining roles with specific privileges and then mapping users to those roles. These privileges define what users can and cannot do within the database, such as which data they can read or write, and which administrative actions they can perform. Therefore, it is very important to apply the principle of least privilege when defining user roles and privileges, so that users are not granted more access than necessary. Or in other words, users should be granted only the minimum level of access necessary to perform their tasks, and no more.
Privileges control the access rights to graph elements using a combined allowlist/denylist mechanism.
It is possible to grant or deny access, or use a combination of the two.
You are able to access a resource if you have a GRANT (allowlist) and do not have a DENY (denylist) relevant to that resource.
All other combinations of GRANT and DENY result in the matching path being inaccessible.
What this means in practice depends on whether you have a read privilege or a write privilege:
-
If an entity is not accessible due to read privileges, the data is invisible. It appears to you as if you had a smaller database (smaller graph).
-
If an entity is not accessible due to write privileges, an error occurs on any attempt to write that data.
|
This page often uses the terms 'allows' and 'enables' in seemingly identical ways. However, there is a subtle difference. 'enables' refers to the consequences of read privileges where a restriction will not cause an error, only a reduction in the apparent graph size. 'allows' refers to the consequence of write privileges where a restriction can result in an error. |
|
If a user was not also provided with the database |
|
For more details about the syntax descriptions, see Database management command syntax. |
Graph privilege commands
Administrators can use the Cypher commands GRANT, DENY, and REVOKE to manage Neo4j graph administrative rights.
These commands can be used to grant or deny privileges to roles, and to revoke previously granted or denied privileges.
The privileges can be granted or denied on the entire graph or specific elements within the graph.
The privileges can also be made immutable, which means they cannot be granted, denied, or revoked unless auth is disabled.
Note that defining privileges for a specific graph or property shard is not supported.
Components of the graph privilege commands
The components of the graph privilege commands are:
-
the command:
-
GRANT– gives privileges to roles. -
DENY– denies privileges to roles. -
REVOKE– removes granted or denied privileges from roles.
-
-
mutability:
-
IMMUTABLEcan optionally be specified when performing aGRANTorDENYto indicate that the privilege cannot be subsequently removed unless auth is disabled. Auth must also be disabled in order toGRANTorDENYan immutable privilege. Contrastingly, whenIMMUTABLEis specified in conjunction with aREVOKEcommand, it will act as a filter and only remove matching immutable privileges. Immutable privileges can also be used together with immutable roles. See Immutable roles and privileges for more information.
-
-
graph-privilege:
-
Can be either a read privilege or write privilege.
-
-
name:
-
The graph or graphs to associate the privilege with. Because in Neo4j 2026.08 you can have only one graph per database, this command uses the database name or alias to refer to that graph. When using an alias, the command will be executed on the resolved graph.
If you delete a database and create a new one with the same name, the new one will NOT have the privileges previously assigned to the deleted graph.
-
It can be
*, which means all graphs. Graphs created after this command execution will also be associated with these privileges. -
HOME GRAPHrefers to the graph associated with the home database for that user. The default database will be used as home database if a user does not have one configured. If the user’s home database changes for any reason after privileges have been created, then these privileges will be associated with the graph attached to the new database. This can be quite powerful as it allows permissions to be switched from one graph to another simply by changing a user’s home database.
-
-
entity
-
The graph elements this privilege applies to:
-
NODESlabel (nodes with the specified label(s)). -
RELATIONSHIPStype (relationships of the specific type(s)). -
ELEMENTSlabel (both nodes and relationships). -
FORpattern (nodes that match the pattern). See Property-based access control for details
-
-
The label or type can be referred with
*, which means all labels or types. -
Multiple labels or types can be specified, comma-separated.
-
Defaults to
ELEMENTS*if omitted. -
Some of the commands for write privileges do not allow an entity part. See Write privileges for details.
-
The
FORpattern entity is not supported for write privileges.
-
-
role[, …]
-
The role or roles to associate the privilege with, comma-separated.
-
General syntax for graph privilege commands
Command |
|
Syntax |
|
Description |
Grants a privilege to one or multiple roles. |
Command |
|
Syntax |
|
Description |
Denies a privilege to one or multiple roles. |
Command |
|
Syntax |
|
Description |
Revokes a granted privilege from one or multiple roles. |
Command |
|
Syntax |
|
Description |
Revokes a denied privilege from one or multiple roles. |
Command |
|
Syntax |
|
Description |
Revokes a granted or denied privilege from one or multiple roles. |
|
|
Introduced in 2026.03
Privileges may not be denied to a role that has already been assigned to an auth rule. For more information about auth rules, see Attribute-based access control. |
Common errors, such as misspellings or attempts to revoke privileges that have not been granted or denied, will result in notifications.
In Cypher 25, notifications for impossible REVOKE commands, where a user, a role, or a database does not exist, have been replaced with errors.
See Status Codes for Errors & Notifications → List of notification codes for details on notifications.
The general GRANT and DENY syntaxes are illustrated in the following image:
A more detailed syntax illustration for graph privileges would be the following:
{ and } are part of the syntax and not used for grouping.The following image shows the hierarchy between different graph privileges:
Showing supported privileges
Supported privileges can be displayed using the SHOW SUPPORTED PRIVILEGES command.
It shows the privileges that are possible to grant or deny on a server, together with the structure of the privilege.
|
For general information about the |
Command |
|
Syntax |
|
Description |
List all privileges supported by the server. |
When using the RETURN clause, the YIELD clause is mandatory and must not be omitted.
Results will include multiple columns describing the privileges:
| Column | Description | Type |
|---|---|---|
|
The privilege action. |
|
|
Qualifier to further limit the target of the privilege ( |
|
|
Target of the privilege: |
|
|
List of possible scopes for the privilege ( |
|
|
A short description of the privilege. |
|
If a privilege lists a qualifier, it has to be used in the command by either an identifier or * if it should affect all identifiers.
The below table demonstrates how qualifiers are used:
| qualifier | example |
|---|---|
|
|
|
|
|
|
|
|
|
|
|
|
It is optional to specify the scope of a privilege.
If it is not specified, the default scope will be ELEMENT *.
Note that not all privileges have a scope.
Examples for showing supported privileges
SHOW SUPPORTED PRIVILEGES YIELD * ORDER BY action DESC LIMIT 13 RETURN action, qualifier, target, scope, descriptionLists 13 supported privileges:
+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | action | qualifier | target | scope | description | +-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | "write secrets" | NULL | "dbms" | NULL | "enables the specified roles to write secrets to the secrets manager" | | "write" | NULL | "graph" | NULL | "allows all WRITE operations on an entire graph" | | "user metadata management" | NULL | "dbms" | NULL | "enables the specified roles to set, remove, and view attributes and tags on users" | | "user management" | NULL | "dbms" | NULL | "enables the specified roles to create, delete, modify, and list users" | | "traverse" | NULL | "graph" | ["elements", "nodes", "pattern", "relationships"] | "enables the specified entities to be found" | | "transaction management" | "username" | "database" | NULL | "allows listing and ending transactions and queries for the specified users on the specified database" | | "terminate transactions" | "username" | "database" | NULL | "allows ending transactions and queries for the specified users on the specified database" | | "stop" | NULL | "database" | NULL | "allows the specified database to be stopped" | | "start" | NULL | "database" | NULL | "allows the specified database to be started" | | "show user metadata" | NULL | "dbms" | NULL | "enables the specified roles to view attributes and tags on users" | | "show user" | NULL | "dbms" | NULL | "enables the specified roles to list users" | | "show transactions" | "username" | "database" | NULL | "allows listing transactions and queries for the specified users on the specified database" | | "show settings" | "setting" | "dbms" | NULL | "enables the specified roles to show the specified configuration settings" | +-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ 13 rows ready to start consuming query after 7 ms, results consumed after another 3 ms
Showing assigned privileges
Privileges that have been granted or denied to roles can be displayed using the following SHOW PRIVILEGE[S] commands.
|
For general information about the |
Command |
|
Syntax |
|
Description |
List all granted or denied privileges. |
Command |
|
Syntax |
|
Description |
List privileges granted or denied to a specific role. |
Command |
|
Syntax |
|
Description |
List privileges for a specific user, or the current user. [NOTE]
====
Please note that it is only possible for a user to show their own privileges.
Therefore, if a non-native auth provider like LDAP is in use, Other users' privileges cannot be listed when using a non-native auth provider. ==== |
When using the RETURN clause, the YIELD clause is mandatory and must not be omitted.
For an easy overview of the existing privileges, it is recommended to use the AS COMMANDS version of the SHOW command, which returns two columns.
| Column | Description | Type |
|---|---|---|
command |
The privilege as the command that is granted or denied.
Or in the |
|
immutable |
Whether or not the privilege is immutable. |
|
Alternatively, you can omit the AS COMMANDS clause and get the full details of the privileges returned in multiple columns.
They are all returned by default without requiring a YIELD.
| Column | Description | Type |
|---|---|---|
|
Whether the privilege is granted or denied. |
|
|
The type of the privilege. E.g., traverse, read, index management, or role management. |
|
|
The scope of the privilege. E.g., the entire DBMS, a specific database, a graph, or sub-graph access. |
|
|
The specific database or graph the privilege applies to. |
|
|
The labels, relationship types, pattern, procedures, functions, transactions or settings the privilege applies to (if applicable). |
|
|
The role the privilege is granted to. |
|
|
Whether or not the privilege is immutable. |
|
|
The user the privilege belongs to. Note that this is only returned for |
|
Examples for showing all privileges
Assigned privileges can be displayed using the different SHOW PRIVILEGE[S] commands.
SHOW [ALL] PRIVILEGE[S] [AS [REVOKE] COMMAND[S]]
[WHERE expression]
SHOW [ALL] PRIVILEGE[S] [AS [REVOKE] COMMAND[S]]
YIELD { * | field[, ...] } [ORDER BY field[, ...]] [SKIP n] [LIMIT n]
[WHERE expression]
[RETURN field[, ...] [ORDER BY field[, ...]] [SKIP n] [LIMIT n]]SHOW PRIVILEGES;Lists all privileges for all roles:
+---------------------------------------------------------------------------------------------------------------------+ | access | action | resource | graph | segment | role | immutable | +---------------------------------------------------------------------------------------------------------------------+ | "GRANTED" | "load" | "file" | "*" | "ALL DATA" | "PUBLIC" | FALSE | | "GRANTED" | "execute" | "database" | "*" | "FUNCTION(*)" | "PUBLIC" | FALSE | | "GRANTED" | "execute" | "database" | "*" | "PROCEDURE(*)" | "PUBLIC" | FALSE | | "GRANTED" | "access" | "database" | "HOME" | "database" | "PUBLIC" | FALSE | | "GRANTED" | "load" | "file" | "*" | "ALL DATA" | "admin" | FALSE | | "GRANTED" | "match" | "all_properties" | "*" | "NODE(*)" | "admin" | FALSE | | "GRANTED" | "write" | "graph" | "*" | "NODE(*)" | "admin" | FALSE | | "GRANTED" | "match" | "all_properties" | "*" | "RELATIONSHIP(*)" | "admin" | FALSE | | "GRANTED" | "write" | "graph" | "*" | "RELATIONSHIP(*)" | "admin" | FALSE | | "GRANTED" | "transaction_management" | "database" | "*" | "USER(*)" | "admin" | FALSE | | "GRANTED" | "access" | "database" | "*" | "database" | "admin" | FALSE | | "GRANTED" | "constraint" | "database" | "*" | "database" | "admin" | FALSE | | "GRANTED" | "dbms_actions" | "database" | "*" | "database" | "admin" | FALSE | | "GRANTED" | "index" | "database" | "*" | "database" | "admin" | FALSE | | "GRANTED" | "show_constraint" | "database" | "*" | "database" | "admin" | FALSE | | "GRANTED" | "show_index" | "database" | "*" | "database" | "admin" | FALSE | | "GRANTED" | "start_database" | "database" | "*" | "database" | "admin" | FALSE | | "GRANTED" | "stop_database" | "database" | "*" | "database" | "admin" | FALSE | | "GRANTED" | "token" | "database" | "*" | "database" | "admin" | FALSE | | "GRANTED" | "match" | "all_properties" | "*" | "NODE(*)" | "architect" | FALSE | | "GRANTED" | "write" | "graph" | "*" | "NODE(*)" | "architect" | FALSE | | "GRANTED" | "match" | "all_properties" | "*" | "RELATIONSHIP(*)" | "architect" | FALSE | | "GRANTED" | "write" | "graph" | "*" | "RELATIONSHIP(*)" | "architect" | FALSE | | "GRANTED" | "access" | "database" | "*" | "database" | "architect" | FALSE | | "GRANTED" | "constraint" | "database" | "*" | "database" | "architect" | FALSE | | "GRANTED" | "index" | "database" | "*" | "database" | "architect" | FALSE | | "GRANTED" | "show_constraint" | "database" | "*" | "database" | "architect" | FALSE | | "GRANTED" | "show_index" | "database" | "*" | "database" | "architect" | FALSE | | "GRANTED" | "token" | "database" | "*" | "database" | "architect" | FALSE | | "GRANTED" | "match" | "all_properties" | "*" | "NODE(*)" | "editor" | FALSE | | "GRANTED" | "write" | "graph" | "*" | "NODE(*)" | "editor" | FALSE | | "GRANTED" | "match" | "all_properties" | "*" | "RELATIONSHIP(*)" | "editor" | FALSE | | "GRANTED" | "write" | "graph" | "*" | "RELATIONSHIP(*)" | "editor" | FALSE | | "GRANTED" | "access" | "database" | "*" | "database" | "editor" | FALSE | | "GRANTED" | "show_constraint" | "database" | "*" | "database" | "editor" | FALSE | | "GRANTED" | "show_index" | "database" | "*" | "database" | "editor" | FALSE | | "DENIED" | "access" | "database" | "neo4j" | "database" | "noAccessUsers" | FALSE | | "GRANTED" | "match" | "all_properties" | "*" | "NODE(*)" | "publisher" | FALSE | | "GRANTED" | "write" | "graph" | "*" | "NODE(*)" | "publisher" | FALSE | | "GRANTED" | "match" | "all_properties" | "*" | "RELATIONSHIP(*)" | "publisher" | FALSE | | "GRANTED" | "write" | "graph" | "*" | "RELATIONSHIP(*)" | "publisher" | FALSE | | "GRANTED" | "access" | "database" | "*" | "database" | "publisher" | FALSE | | "GRANTED" | "show_constraint" | "database" | "*" | "database" | "publisher" | FALSE | | "GRANTED" | "show_index" | "database" | "*" | "database" | "publisher" | FALSE | | "GRANTED" | "token" | "database" | "*" | "database" | "publisher" | FALSE | | "GRANTED" | "match" | "all_properties" | "*" | "NODE(*)" | "reader" | FALSE | | "GRANTED" | "match" | "all_properties" | "*" | "RELATIONSHIP(*)" | "reader" | FALSE | | "GRANTED" | "access" | "database" | "*" | "database" | "reader" | FALSE | | "GRANTED" | "show_constraint" | "database" | "*" | "database" | "reader" | FALSE | | "GRANTED" | "show_index" | "database" | "*" | "database" | "reader" | FALSE | | "GRANTED" | "access" | "database" | "neo4j" | "database" | "regularUsers" | FALSE | +---------------------------------------------------------------------------------------------------------------------+ 51 rows ready to start consuming query after 12 ms, results consumed after another 6 ms
|
The |
It is also possible to filter and sort the results by using YIELD, ORDER BY and WHERE:
SHOW PRIVILEGES YIELD role, access, action, segment
ORDER BY action
WHERE role = 'admin';In this example:
-
The number of columns returned has been reduced with the
YIELDclause. -
The order of the returned columns has been changed.
-
The results have been filtered to only return the
adminrole using aWHEREclause. -
The results are ordered by the
actioncolumn usingORDER BY.
SKIP and LIMIT can also be used to paginate the results.
+--------------------------------------------------------------------+ | role | access | action | segment | +--------------------------------------------------------------------+ | "admin" | "GRANTED" | "access" | "database" | | "admin" | "GRANTED" | "constraint" | "database" | | "admin" | "GRANTED" | "dbms_actions" | "database" | | "admin" | "GRANTED" | "index" | "database" | | "admin" | "GRANTED" | "load" | "ALL DATA" | | "admin" | "GRANTED" | "match" | "NODE(*)" | | "admin" | "GRANTED" | "match" | "RELATIONSHIP(*)" | | "admin" | "GRANTED" | "show_constraint" | "database" | | "admin" | "GRANTED" | "show_index" | "database" | | "admin" | "GRANTED" | "start_database" | "database" | | "admin" | "GRANTED" | "stop_database" | "database" | | "admin" | "GRANTED" | "token" | "database" | | "admin" | "GRANTED" | "transaction_management" | "USER(*)" | | "admin" | "GRANTED" | "write" | "NODE(*)" | | "admin" | "GRANTED" | "write" | "RELATIONSHIP(*)" | +--------------------------------------------------------------------+ 15 rows ready to start consuming query after 6 ms, results consumed after another 2 ms
|
The |
WHERE can also be used without YIELD:
SHOW PRIVILEGES
WHERE graph <> '*';In this example, the WHERE clause is used to filter privileges down to those that target specific graphs only.
+----------------------------------------------------------------------------------------+ | access | action | resource | graph | segment | role | immutable | +----------------------------------------------------------------------------------------+ | "GRANTED" | "access" | "database" | "HOME" | "database" | "PUBLIC" | FALSE | | "DENIED" | "access" | "database" | "neo4j" | "database" | "noAccessUsers" | FALSE | | "GRANTED" | "access" | "database" | "neo4j" | "database" | "regularUsers" | FALSE | +----------------------------------------------------------------------------------------+ 3 rows ready to start consuming query after 3 ms, results consumed after another 2 ms
Aggregations in the RETURN clause can be used to group privileges.
In this case, by user and GRANTED or DENIED:
SHOW PRIVILEGES YIELD * RETURN role, access, collect([graph, resource, segment, action]) AS privileges;+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | role | access | privileges | +----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | "PUBLIC" | "GRANTED" | [["*", "file", "ALL DATA", "load"], ["*", "database", "FUNCTION(*)", "execute"], ["*", "database", "PROCEDURE(*)", "execute"], ["HOME", "database", "database", "access"]] | | "admin" | "GRANTED" | [["*", "file", "ALL DATA", "load"], ["*", "all_properties", "NODE(*)", "match"], ["*", "graph", "NODE(*)", "write"], ["*", "all_properties", "RELATIONSHIP(*)", "match"], ["*", "graph", "RELATIONSHIP(*)", "write"], ["*", "database", "USER(*)", "transaction_management"], ["*", "database", "database", "access"], ["*", "database", "database", "constraint"], ["*", "database", "database", "dbms_actions"], ["*", "database", "database", "index"], ["*", "database", "database", "show_constraint"], ["*", "database", "database", "show_index"], ["*", "database", "database", "start_database"], ["*", "database", "database", "stop_database"], ["*", "database", "database", "token"]] | | "architect" | "GRANTED" | [["*", "all_properties", "NODE(*)", "match"], ["*", "graph", "NODE(*)", "write"], ["*", "all_properties", "RELATIONSHIP(*)", "match"], ["*", "graph", "RELATIONSHIP(*)", "write"], ["*", "database", "database", "access"], ["*", "database", "database", "constraint"], ["*", "database", "database", "index"], ["*", "database", "database", "show_constraint"], ["*", "database", "database", "show_index"], ["*", "database", "database", "token"]] | | "editor" | "GRANTED" | [["*", "all_properties", "NODE(*)", "match"], ["*", "graph", "NODE(*)", "write"], ["*", "all_properties", "RELATIONSHIP(*)", "match"], ["*", "graph", "RELATIONSHIP(*)", "write"], ["*", "database", "database", "access"], ["*", "database", "database", "show_constraint"], ["*", "database", "database", "show_index"]] | | "noAccessUsers" | "DENIED" | [["neo4j", "database", "database", "access"]] | | "publisher" | "GRANTED" | [["*", "all_properties", "NODE(*)", "match"], ["*", "graph", "NODE(*)", "write"], ["*", "all_properties", "RELATIONSHIP(*)", "match"], ["*", "graph", "RELATIONSHIP(*)", "write"], ["*", "database", "database", "access"], ["*", "database", "database", "show_constraint"], ["*", "database", "database", "show_index"], ["*", "database", "database", "token"]] | | "reader" | "GRANTED" | [["*", "all_properties", "NODE(*)", "match"], ["*", "all_properties", "RELATIONSHIP(*)", "match"], ["*", "database", "database", "access"], ["*", "database", "database", "show_constraint"], ["*", "database", "database", "show_index"]] | | "regularUsers" | "GRANTED" | [["neo4j", "database", "database", "access"]] | +----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ 8 rows ready to start consuming query after 3 ms, results consumed after another 1 ms
|
The |
The RETURN clause can also be used to order and paginate the results, which is useful when combined with YIELD and WHERE.
In this example the query returns privileges for display five-per-page, and skips the first five to display the second page.
SHOW PRIVILEGES YIELD * RETURN * ORDER BY role SKIP 5 LIMIT 5;+-----------------------------------------------------------------------------------------------------------+ | access | action | resource | graph | segment | role | immutable | +-----------------------------------------------------------------------------------------------------------+ | "GRANTED" | "match" | "all_properties" | "*" | "NODE(*)" | "admin" | FALSE | | "GRANTED" | "write" | "graph" | "*" | "NODE(*)" | "admin" | FALSE | | "GRANTED" | "match" | "all_properties" | "*" | "RELATIONSHIP(*)" | "admin" | FALSE | | "GRANTED" | "write" | "graph" | "*" | "RELATIONSHIP(*)" | "admin" | FALSE | | "GRANTED" | "transaction_management" | "database" | "*" | "USER(*)" | "admin" | FALSE | +-----------------------------------------------------------------------------------------------------------+ 5 rows ready to start consuming query after 78 ms, results consumed after another 5 ms
Available privileges can also be displayed as Cypher commands by adding AS COMMAND[S]:
SHOW PRIVILEGES AS COMMANDS;+-------------------------------------------------------------+
| command |
+-------------------------------------------------------------+
| "DENY ACCESS ON DATABASE `neo4j` TO `noAccessUsers`" |
| "GRANT ACCESS ON DATABASE * TO `admin`" |
| "GRANT ACCESS ON DATABASE * TO `architect`" |
| "GRANT ACCESS ON DATABASE * TO `editor`" |
| "GRANT ACCESS ON DATABASE * TO `publisher`" |
| "GRANT ACCESS ON DATABASE * TO `reader`" |
| "GRANT ACCESS ON DATABASE `neo4j` TO `regularUsers`" |
| "GRANT ACCESS ON HOME DATABASE TO `PUBLIC`" |
| "GRANT ALL DBMS PRIVILEGES ON DBMS TO `admin`" |
| "GRANT CONSTRAINT MANAGEMENT ON DATABASE * TO `admin`" |
| "GRANT CONSTRAINT MANAGEMENT ON DATABASE * TO `architect`" |
| "GRANT EXECUTE PROCEDURE * ON DBMS TO `PUBLIC`" |
| "GRANT EXECUTE USER DEFINED FUNCTION * ON DBMS TO `PUBLIC`" |
| "GRANT INDEX MANAGEMENT ON DATABASE * TO `admin`" |
| "GRANT INDEX MANAGEMENT ON DATABASE * TO `architect`" |
| "GRANT LOAD ON ALL DATA TO `PUBLIC`" |
| "GRANT LOAD ON ALL DATA TO `admin`" |
| "GRANT MATCH {*} ON GRAPH * NODE * TO `admin`" |
| "GRANT MATCH {*} ON GRAPH * NODE * TO `architect`" |
| "GRANT MATCH {*} ON GRAPH * NODE * TO `editor`" |
| "GRANT MATCH {*} ON GRAPH * NODE * TO `publisher`" |
| "GRANT MATCH {*} ON GRAPH * NODE * TO `reader`" |
| "GRANT MATCH {*} ON GRAPH * RELATIONSHIP * TO `admin`" |
| "GRANT MATCH {*} ON GRAPH * RELATIONSHIP * TO `architect`" |
| "GRANT MATCH {*} ON GRAPH * RELATIONSHIP * TO `editor`" |
| "GRANT MATCH {*} ON GRAPH * RELATIONSHIP * TO `publisher`" |
| "GRANT MATCH {*} ON GRAPH * RELATIONSHIP * TO `reader`" |
| "GRANT NAME MANAGEMENT ON DATABASE * TO `admin`" |
| "GRANT NAME MANAGEMENT ON DATABASE * TO `architect`" |
| "GRANT NAME MANAGEMENT ON DATABASE * TO `publisher`" |
| "GRANT SHOW CONSTRAINT ON DATABASE * TO `admin`" |
| "GRANT SHOW CONSTRAINT ON DATABASE * TO `architect`" |
| "GRANT SHOW CONSTRAINT ON DATABASE * TO `editor`" |
| "GRANT SHOW CONSTRAINT ON DATABASE * TO `publisher`" |
| "GRANT SHOW CONSTRAINT ON DATABASE * TO `reader`" |
| "GRANT SHOW INDEX ON DATABASE * TO `admin`" |
| "GRANT SHOW INDEX ON DATABASE * TO `architect`" |
| "GRANT SHOW INDEX ON DATABASE * TO `editor`" |
| "GRANT SHOW INDEX ON DATABASE * TO `publisher`" |
| "GRANT SHOW INDEX ON DATABASE * TO `reader`" |
| "GRANT START ON DATABASE * TO `admin`" |
| "GRANT STOP ON DATABASE * TO `admin`" |
| "GRANT TRANSACTION MANAGEMENT (*) ON DATABASE * TO `admin`" |
| "GRANT WRITE ON GRAPH * TO `admin`" |
| "GRANT WRITE ON GRAPH * TO `architect`" |
| "GRANT WRITE ON GRAPH * TO `editor`" |
| "GRANT WRITE ON GRAPH * TO `publisher`" |
+-------------------------------------------------------------+
47 rows
ready to start consuming query after 30 ms, results consumed after another 2 ms
Like other SHOW commands, the output can also be processed using YIELD / WHERE / RETURN:
SHOW PRIVILEGES AS COMMANDS
WHERE command CONTAINS 'MANAGEMENT';+-------------------------------------------------------------+ | command | +-------------------------------------------------------------+ | "GRANT CONSTRAINT MANAGEMENT ON DATABASE * TO `admin`" | | "GRANT CONSTRAINT MANAGEMENT ON DATABASE * TO `architect`" | | "GRANT INDEX MANAGEMENT ON DATABASE * TO `admin`" | | "GRANT INDEX MANAGEMENT ON DATABASE * TO `architect`" | | "GRANT NAME MANAGEMENT ON DATABASE * TO `admin`" | | "GRANT NAME MANAGEMENT ON DATABASE * TO `architect`" | | "GRANT NAME MANAGEMENT ON DATABASE * TO `publisher`" | | "GRANT TRANSACTION MANAGEMENT (*) ON DATABASE * TO `admin`" | +-------------------------------------------------------------+ 8 rows ready to start consuming query after 71 ms, results consumed after another 5 ms
It is also possible to show the privileges as revoking commands instead of granting or denying:
SHOW PRIVILEGES AS REVOKE COMMANDS;+----------------------------------------------------------------------+
| command |
+----------------------------------------------------------------------+
| "REVOKE DENY ACCESS ON DATABASE `neo4j` FROM `noAccessUsers`" |
| "REVOKE GRANT ACCESS ON DATABASE * FROM `admin`" |
| "REVOKE GRANT ACCESS ON DATABASE * FROM `architect`" |
| "REVOKE GRANT ACCESS ON DATABASE * FROM `editor`" |
| "REVOKE GRANT ACCESS ON DATABASE * FROM `publisher`" |
| "REVOKE GRANT ACCESS ON DATABASE * FROM `reader`" |
| "REVOKE GRANT ACCESS ON DATABASE `neo4j` FROM `regularUsers`" |
| "REVOKE GRANT ACCESS ON HOME DATABASE FROM `PUBLIC`" |
| "REVOKE GRANT ALL DBMS PRIVILEGES ON DBMS FROM `admin`" |
| "REVOKE GRANT CONSTRAINT MANAGEMENT ON DATABASE * FROM `admin`" |
| "REVOKE GRANT CONSTRAINT MANAGEMENT ON DATABASE * FROM `architect`" |
| "REVOKE GRANT EXECUTE PROCEDURE * ON DBMS FROM `PUBLIC`" |
| "REVOKE GRANT EXECUTE USER DEFINED FUNCTION * ON DBMS FROM `PUBLIC`" |
| "REVOKE GRANT INDEX MANAGEMENT ON DATABASE * FROM `admin`" |
| "REVOKE GRANT INDEX MANAGEMENT ON DATABASE * FROM `architect`" |
| "REVOKE GRANT LOAD ON ALL DATA FROM `PUBLIC`" |
| "REVOKE GRANT LOAD ON ALL DATA FROM `admin`" |
| "REVOKE GRANT MATCH {*} ON GRAPH * NODE * FROM `admin`" |
| "REVOKE GRANT MATCH {*} ON GRAPH * NODE * FROM `architect`" |
| "REVOKE GRANT MATCH {*} ON GRAPH * NODE * FROM `editor`" |
| "REVOKE GRANT MATCH {*} ON GRAPH * NODE * FROM `publisher`" |
| "REVOKE GRANT MATCH {*} ON GRAPH * NODE * FROM `reader`" |
| "REVOKE GRANT MATCH {*} ON GRAPH * RELATIONSHIP * FROM `admin`" |
| "REVOKE GRANT MATCH {*} ON GRAPH * RELATIONSHIP * FROM `architect`" |
| "REVOKE GRANT MATCH {*} ON GRAPH * RELATIONSHIP * FROM `editor`" |
| "REVOKE GRANT MATCH {*} ON GRAPH * RELATIONSHIP * FROM `publisher`" |
| "REVOKE GRANT MATCH {*} ON GRAPH * RELATIONSHIP * FROM `reader`" |
| "REVOKE GRANT NAME MANAGEMENT ON DATABASE * FROM `admin`" |
| "REVOKE GRANT NAME MANAGEMENT ON DATABASE * FROM `architect`" |
| "REVOKE GRANT NAME MANAGEMENT ON DATABASE * FROM `publisher`" |
| "REVOKE GRANT SHOW CONSTRAINT ON DATABASE * FROM `admin`" |
| "REVOKE GRANT SHOW CONSTRAINT ON DATABASE * FROM `architect`" |
| "REVOKE GRANT SHOW CONSTRAINT ON DATABASE * FROM `editor`" |
| "REVOKE GRANT SHOW CONSTRAINT ON DATABASE * FROM `publisher`" |
| "REVOKE GRANT SHOW CONSTRAINT ON DATABASE * FROM `reader`" |
| "REVOKE GRANT SHOW INDEX ON DATABASE * FROM `admin`" |
| "REVOKE GRANT SHOW INDEX ON DATABASE * FROM `architect`" |
| "REVOKE GRANT SHOW INDEX ON DATABASE * FROM `editor`" |
| "REVOKE GRANT SHOW INDEX ON DATABASE * FROM `publisher`" |
| "REVOKE GRANT SHOW INDEX ON DATABASE * FROM `reader`" |
| "REVOKE GRANT START ON DATABASE * FROM `admin`" |
| "REVOKE GRANT STOP ON DATABASE * FROM `admin`" |
| "REVOKE GRANT TRANSACTION MANAGEMENT (*) ON DATABASE * FROM `admin`" |
| "REVOKE GRANT WRITE ON GRAPH * FROM `admin`" |
| "REVOKE GRANT WRITE ON GRAPH * FROM `architect`" |
| "REVOKE GRANT WRITE ON GRAPH * FROM `editor`" |
| "REVOKE GRANT WRITE ON GRAPH * FROM `publisher`" |
+----------------------------------------------------------------------+
47 rows
ready to start consuming query after 9 ms, results consumed after another 1 ms
For more info about revoking privileges, please see The REVOKE command.
Examples for showing privileges for specific roles
Available privileges for specific roles can be displayed using SHOW ROLE name PRIVILEGE[S]:
SHOW ROLE[S] name[, ...] PRIVILEGE[S] [AS [REVOKE] COMMAND[S]]
[WHERE expression]
SHOW ROLE[S] name[, ...] PRIVILEGE[S] [AS [REVOKE] COMMAND[S]]
YIELD { * | field[, ...] } [ORDER BY field[, ...]] [SKIP n] [LIMIT n]
[WHERE expression]
[RETURN field[, ...] [ORDER BY field[, ...]] [SKIP n] [LIMIT n]]SHOW ROLE regularUsers PRIVILEGES;Lists all privileges for role regularUsers.
+---------------------------------------------------------------------------------------+ | access | action | resource | graph | segment | role | immutable | +---------------------------------------------------------------------------------------+ | "GRANTED" | "access" | "database" | "neo4j" | "database" | "regularUsers" | FALSE | +---------------------------------------------------------------------------------------+ 1 row ready to start consuming query after 40 ms, results consumed after another 1 ms
SHOW ROLES regularUsers, noAccessUsers PRIVILEGES;Lists all privileges for roles regularUsers and noAccessUsers.
+----------------------------------------------------------------------------------------+ | access | action | resource | graph | segment | role | immutable | +----------------------------------------------------------------------------------------+ | "DENIED" | "access" | "database" | "neo4j" | "database" | "noAccessUsers" | FALSE | | "GRANTED" | "access" | "database" | "neo4j" | "database" | "regularUsers" | FALSE | +----------------------------------------------------------------------------------------+ 2 rows ready to start consuming query after 41 ms, results consumed after another 1 ms
Similar to the other SHOW PRIVILEGES commands, the available privileges for roles can also be listed as Cypher commands with the optional AS COMMAND[S].
SHOW ROLES regularUsers, noAccessUsers PRIVILEGES AS COMMANDS;+------------------------------------------------------+ | command | +------------------------------------------------------+ | "DENY ACCESS ON DATABASE `neo4j` TO `noAccessUsers`" | | "GRANT ACCESS ON DATABASE `neo4j` TO `regularUsers`" | +------------------------------------------------------+ 2 rows ready to start consuming query after 3 ms, results consumed after another 0 ms
The output can be processed using YIELD / WHERE / RETURN here as well:
SHOW ROLE architect PRIVILEGES AS COMMANDS WHERE command CONTAINS 'MATCH';+------------------------------------------------------------+
| command |
+------------------------------------------------------------+
| "GRANT MATCH {*} ON GRAPH * NODE * TO `architect`" |
| "GRANT MATCH {*} ON GRAPH * RELATIONSHIP * TO `architect`" |
+------------------------------------------------------------+
2 rows
ready to start consuming query after 32 ms, results consumed after another 1 ms
Again, it is possible to show the privileges as revoking commands instead of granting or denying. For more info about revoking privileges, please see The REVOKE command.
SHOW ROLE reader PRIVILEGES AS REVOKE COMMANDS;+------------------------------------------------------------------+
| command |
+------------------------------------------------------------------+
| "REVOKE GRANT ACCESS ON DATABASE * FROM `reader`" |
| "REVOKE GRANT MATCH {*} ON GRAPH * NODE * FROM `reader`" |
| "REVOKE GRANT MATCH {*} ON GRAPH * RELATIONSHIP * FROM `reader`" |
| "REVOKE GRANT SHOW CONSTRAINT ON DATABASE * FROM `reader`" |
| "REVOKE GRANT SHOW INDEX ON DATABASE * FROM `reader`" |
+------------------------------------------------------------------+
5 rows
ready to start consuming query after 9 ms, results consumed after another 1 ms
Examples for showing privileges for specific users
Available privileges for specific users can be displayed using SHOW USER name PRIVILEGES.
|
Note that if a non-native auth provider like LDAP is in use, |
SHOW USER[S] [name[, ...]] PRIVILEGE[S] [AS [REVOKE] COMMAND[S]]
[WHERE expression]
SHOW USER[S] [name[, ...]] PRIVILEGE[S] [AS [REVOKE] COMMAND[S]]
YIELD { * | field[, ...] } [ORDER BY field[, ...]] [SKIP n] [LIMIT n]
[WHERE expression]
[RETURN field[, ...] [ORDER BY field[, ...]] [SKIP n] [LIMIT n]]SHOW USER jake PRIVILEGES;Lists all privileges for user jake.
+-----------------------------------------------------------------------------------------------------+ | access | action | resource | graph | segment | role | immutable | user | +-----------------------------------------------------------------------------------------------------+ | "GRANTED" | "load" | "file" | "*" | "ALL DATA" | "PUBLIC" | FALSE | "jake" | | "GRANTED" | "execute" | "database" | "*" | "FUNCTION(*)" | "PUBLIC" | FALSE | "jake" | | "GRANTED" | "execute" | "database" | "*" | "PROCEDURE(*)" | "PUBLIC" | FALSE | "jake" | | "GRANTED" | "access" | "database" | "HOME" | "database" | "PUBLIC" | FALSE | "jake" | | "GRANTED" | "access" | "database" | "neo4j" | "database" | "regularUsers" | FALSE | "jake" | +-----------------------------------------------------------------------------------------------------+ 5 rows ready to start consuming query after 45 ms, results consumed after another 1 ms
SHOW USERS jake, joe PRIVILEGES;Lists all privileges for users jake and joe.
+------------------------------------------------------------------------------------------------------+ | access | action | resource | graph | segment | role | immutable | user | +------------------------------------------------------------------------------------------------------+ | "GRANTED" | "load" | "file" | "*" | "ALL DATA" | "PUBLIC" | FALSE | "jake" | | "GRANTED" | "execute" | "database" | "*" | "FUNCTION(*)" | "PUBLIC" | FALSE | "jake" | | "GRANTED" | "execute" | "database" | "*" | "PROCEDURE(*)" | "PUBLIC" | FALSE | "jake" | | "GRANTED" | "access" | "database" | "HOME" | "database" | "PUBLIC" | FALSE | "jake" | | "GRANTED" | "access" | "database" | "neo4j" | "database" | "regularUsers" | FALSE | "jake" | | "GRANTED" | "load" | "file" | "*" | "ALL DATA" | "PUBLIC" | FALSE | "joe" | | "GRANTED" | "execute" | "database" | "*" | "FUNCTION(*)" | "PUBLIC" | FALSE | "joe" | | "GRANTED" | "execute" | "database" | "*" | "PROCEDURE(*)" | "PUBLIC" | FALSE | "joe" | | "GRANTED" | "access" | "database" | "HOME" | "database" | "PUBLIC" | FALSE | "joe" | | "DENIED" | "access" | "database" | "neo4j" | "database" | "noAccessUsers" | FALSE | "joe" | +------------------------------------------------------------------------------------------------------+ 10 rows ready to start consuming query after 9 ms, results consumed after another 0 ms
The same command can be used at all times to review available privileges for the current user.
For this purpose, there is a shorter form of the command: SHOW USER PRIVILEGES:
SHOW USER PRIVILEGES;As for the other privilege commands, available privileges for users can also be listed as Cypher commands with the optional AS COMMAND[S].
|
When showing user privileges as commands, the roles in the Cypher commands are replaced with a parameter. This can be used to quickly create new roles based on the privileges of specific users. |
SHOW USER jake PRIVILEGES AS COMMANDS;+----------------------------------------------------------+ | command | +----------------------------------------------------------+ | "GRANT ACCESS ON DATABASE `neo4j` TO $role" | | "GRANT ACCESS ON HOME DATABASE TO $role" | | "GRANT EXECUTE PROCEDURE * ON DBMS TO $role" | | "GRANT EXECUTE USER DEFINED FUNCTION * ON DBMS TO $role" | | "GRANT LOAD ON ALL DATA TO $role" | +----------------------------------------------------------+ 5 rows ready to start consuming query after 20 ms, results consumed after another 1 ms
Like other SHOW commands, the output can also be processed using YIELD / WHERE / RETURN.
Additionally, similar to the other show privilege commands, it is also possible to show the commands for revoking the privileges.
SHOW USER jake PRIVILEGES AS REVOKE COMMANDS
WHERE command CONTAINS 'EXECUTE';+-------------------------------------------------------------------+ | command | +-------------------------------------------------------------------+ | "REVOKE GRANT EXECUTE PROCEDURE * ON DBMS FROM $role" | | "REVOKE GRANT EXECUTE USER DEFINED FUNCTION * ON DBMS FROM $role" | +-------------------------------------------------------------------+ 2 rows ready to start consuming query after 19 ms, results consumed after another 0 ms
Revoking privileges
Privileges that were granted or denied earlier can be revoked using the REVOKE command:
REVOKE
[ IMMUTABLE ]
[ GRANT | DENY ] graph-privilege
FROM role[, ...]An example usage of the REVOKE command is given here:
REVOKE GRANT TRAVERSE ON HOME GRAPH NODES Post FROM regularUsers;While it can be explicitly specified that REVOKE should remove a GRANT or DENY, it is also possible to REVOKE both by not specifying them at all, as the next example demonstrates.
Because of this, if there happens to be a GRANT and a DENY for the same privilege, it would remove both.
REVOKE TRAVERSE ON HOME GRAPH NODES Payments FROM regularUsers;Adding IMMUTABLE explicitly specifies that only immutable privileges should be removed. Omitting it specifies that both immutable and regular privileges should be removed.
Glossary
- allocator
-
A component in the cluster that allocates databases to servers according to the topology constraints specified and an allocation strategy.
- asynchronous replication
-
Asynchronous replication is used by secondary copies to poll for new transactions, which means they cannot be guaranteed to have received the most recent transactions. This enables efficient scale-out of read-performance.
- Aura instance
-
A fully-managed DBMS represented by a single instance ID, that is running in the Neo4j Aura cloud.
- auto-commit transaction
-
An automatically committed transaction that contains a single query.
- Bolt protocol
-
Bolt is a protocol used for interaction between Neo4j instances and drivers.
- bookmark
-
A marker the client can request from the cluster to ensure that it is able to read its own writes so that the application’s state is consistent and only databases that have a copy of the bookmark are permitted to respond.
- category (Bloom)
-
A category is based on a node label and is defined in a Perspective as a way of visually distinguishing nodes with the same label(s).
- causal consistency
-
All servers in a cluster agree on the order in which transactions take place. The position of a server on the causal chain can be guaranteed using a bookmark.
- cluster
-
A Neo4j DBMS that spans multiple servers working together to increase fault tolerance and/or read scalability. Databases on a cluster may be configured to replicate across servers in the cluster thus achieving read scalability or high availability.
- client application
-
Software that interacts with a Neo4j server.
- commit
-
A commit is the successful completion of a transaction, which ensures durability of any changes made. For more details, visit Operations Manual → Transaction management.
- composite database
-
Composite databases are the means to access partitioned graph data with a single Cypher query.
- constraint
-
Constraints are sets of data modeling rules that ensure the data is consistent and reliable.
- Cypher®
-
Neo4j’s graph query language.
- data model
-
A data model defines how information is organized in a database. A good data model will make querying and understanding your data easier. In Neo4j, the data models have a graph structure.
- database
-
A database is a container used by the DBMS to manage and store graph data. The physical structure of data is controlled by the database.
- database vs graph
-
Databases are the physical containers of graph data. Graphs are the logical structure of data in Neo4j.
- Database Management System
-
Database Management System, or DBMS, capable of managing multiple databases. A DBMS may run on a single server, or span several servers configured as a cluster.
- database schema
-
The prescribed property existence and datatypes for nodes and relationships.
- deallocate
-
An act of removing a database from a server or a server from a cluster without loss of data or reduced fault tolerance.
- degree (of a node)
-
The number of relationships of a specific node; loops are counted twice.
- disaster recovery
-
A manual intervention to restore availability of a cluster, or databases within a cluster.
- driver
-
A software library that provides access to Neo4j from a particular programming language.
- election
-
In the event that the Raft leader becomes unresponsive, followers automatically trigger an election and vote for a new leader.
- entity
-
A node or a relationship.
- expression (Cypher)
-
A component of a Cypher query which produces values. It may be used in projections, as a predicate, or when setting properties on graph elements.
- fabric
-
Fabric is the architectural design of a unified system that provides a single access point to local or distributed graph data.
- fault tolerance
-
A guarantee that a cluster can maintain a database’s persistence and availability in the event of one or more servers failing.
- follower
-
A primary copy of a database acting as a follower, receives and acknowledges synchronous writes from the leader.
- Generative AI (GenAI)
-
A type of artificial intelligence (AI) system that generates text, images, or other media in response to prompts.
- graph
-
A logical representation of a set of nodes where some pairs are connected by relationships.
- index
-
Data structure that improves read performance of a database.
- knowledge graph
-
A specific type of graph that has an organizing principle so that a user (or a computer system) can reason about the underlying data. The organizing principle provides an additional layer of structure that adds context to support knowledge discovery.
- label
-
Marks a node as a member of a named and indexed subset. A node may be assigned zero or more labels.
- leader
-
A single primary copy of a database is designated as the leader. It receives all write transactions from clients and replicates writes synchronously to followers and asynchronously to secondary copies of the database.
- main database
-
In terms of Neo4j Enterprise Studio, the database(s) containing the user’s data. Can exist in the same Neo4j deployment as the tool asset database.
- motif
-
A description of a specific pattern within a graph.
- node
-
A node represents an entity or discrete object in your graph data model. Nodes can be connected by relationships, hold data in properties, and are classified by labels.
- operator
-
A symbol representing a mathematical or logical operation.
- parameter
-
Named value provided when running a Cypher statement.
- path
-
A sequence of nodes and the relationships connecting them, that does not contain duplicate relationships. Several paths can match a pattern.
- pattern
-
A specific arrangement of nodes and relationships that can be matched in a graph. A pattern follows a motif.
- perspective (Bloom)
-
A Perspective defines a certain business view or domain that can be found in the target Neo4j graph. A single Neo4j graph can be viewed through different Perspectives, each tailored for a different business purpose.
- primary
-
A copy of the database that is able to process write transactions and is eligible to be elected as a leader. It participates in fault tolerant writes as it is part of the majority required to acknowledge and commit write transactions.
- primary vs secondary
-
In a cluster, databases can operate in either primary or secondary mode. Primary databases are able to process write and read transactions, ensuring fault tolerance. Secondary databases are replicated asynchronously from primaries, and their main purpose is to provide read scaling within the cluster.
- project (Aura)
-
An isolated environment in the unified Aura console that contains its own database instances, configurations, and resources. Preceded by tenant in the classic Aura console.
- property
-
Properties are key-value pairs that are used for storing data on nodes and relationships.
- query (Cypher)
-
A statement that retrieves or writes information to a database.
- Raft group
-
A group of servers that are participating in hosting a particular database in primary mode.
- Raft group member
-
A server that is participating in a Raft group. A server can be a member of one or more groups.
- Raft log
-
A shared log between all Raft group members that is guaranteed to be consistently updated and viewed by those members. The log contains both database data and operational state of the Raft group.
- Raft protocol
-
The networking mechanism that enables a database to replicate its data across multiple servers to give high availability for accessing the data and high durability to the data stored.
- read scaling
-
Distributing query load by creating additional database copies hosted in secondary mode (read-only).
- relationship
-
A relationship represents a connection between nodes in your graph data model. Relationships connect a source node to a target node, hold data in properties, and are classified by type.
- secondary
-
An asynchronously replicated copy of the database that provides read scaling within the cluster.
- seed
-
A seed is a database dump or a full backup used to create a database on a cluster. This is sometimes called seeding.
- server
-
A physical machine, a virtual machine, or a container running an instance of Neo4j. Servers can be standalone or part of a cluster.
- session
-
A causally linked sequence of transactions.
- session consistency
-
An alternative name for Neo4j’s causal consistency.
- standalone
-
A single server running Neo4j and not part of a cluster.
- synchronous replication
-
Synchronous replication requires the leader primary to replicate a transaction and block the commit until a quorum of the follower primaries acknowledges that the transaction is successfully replicated. Once the transaction is replicated, the commit is allowed to proceed. This ensures data durability and consistency within the cluster.
- system database
-
A database used by Neo4j to store system information.
- tenant (Aura)
-
An isolated environment in the classic Aura console that contains its own database instances, configurations, and resources. Replaced by project in the unified Aura console.
- tool asset database
-
In terms of Neo4j Enterprise Studio, the database where tools' assets are stored. This can be in the same Neo4j deployment as the main database(s) or in a separate deployment.
- topology
-
A configuration that describes how the copies of a database should be spread across the servers in a cluster, see primary mode and secondary mode.
- transaction
-
A transaction comprises a unit of work performed against a database. It is treated in a coherent and reliable way, independent of other transactions. Transactions comply with the ACID consistency model (atomic, consistent, isolated, and durable).