# Create read-only database user by using "GRANT DQL"

**URL:** <https://community.cratedb.com/t/create-read-only-database-user-by-using-grant-dql/2031>\
**Category:** Tutorials\
**Tags:** sql, privileges\
**Created:** [May 17, 2025, 6:45pm UTC](https://community.cratedb.com/t/create-read-only-database-user-by-using-grant-dql/2031 "2025-05-17T18:45:57Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![amotl](https://sea2.discourse-cdn.com/flex020/user_avatar/community.cratedb.com/amotl/32/617_2.png) [@amotl](https://community.cratedb.com/u/amotl)\
**Post date:** [May 17, 2025, 6:45pm UTC](https://community.cratedb.com/t/create-read-only-database-user-by-using-grant-dql/2031/1 "2025-05-17T18:45:57Z")

</div>

## Introduction

Data flows in analytical applications like pulling data into business intelligence or visualization tools typically only needs read-only access to database tables and views.

CrateDB’s privilege system provides the [`DQL` privilege type](https://cratedb.com/docs/crate/reference/en/latest/admin/privileges.html#dql) to assign corresponding read-only permissions to a database user, see also [users and roles management](https://cratedb.com/docs/crate/reference/en/latest/admin/user-management.html).

## Usage

Create database user.

```sql
CREATE USER "read-only" WITH (password = '<YOUR_PASSWORD>');

```

Assign privilege type `DQL`, applying to all privilege classes.

```sql
GRANT DQL TO "read-only";

```

### Privilege classes

CrateDB permissions are assigned to [privilege classes](https://cratedb.com/docs/crate/reference/en/latest/admin/privileges.html#privilege-classes). In this case, to assign read-only access to individual entities, use the `SCHEMA`, `TABLE`, or `VIEW` class identifiers.

```sql
GRANT DQL ON SCHEMA doc TO "read-only";
GRANT DQL ON TABLE doc.testdrive TO "read-only";
GRANT DQL ON VIEW doc.testdrive TO "read-only";

```

### Verify

When authenticating using the database user, for example using [crash](https://cratedb.com/docs/crate/crash/), you can verify that DDL and DML operations are not permitted.

```shell
crash --hosts http://read-only:foo@localhost:4200/

```

```sql
cr> CREATE TABLE t01 (id INT);
MissingPrivilegeException[Missing 'DDL' privilege for user 'read-only']

```

## Appendix

The reference documentation pages include essential details about CrateDB’s privilege system. In particular, we would like to highlight the sections about [hierarchical inheritance of privileges](https://cratedb.com/docs/crate/reference/en/latest/admin/privileges.html#hierarchical-inheritance-of-privileges) and [privilege details of database VIEWs](https://cratedb.com/docs/crate/reference/en/latest/general/ddl/views.html#privileges).