oh grant

Grant privileges, roles, group / service-principal membership, and fine-grained data access.

Every subcommand targets exactly one principal, chosen with one of:

Flag	Target
--user EMAIL	A user, by email
--group NAME	A group
--service-principal NAME	A service principal

To revoke, use the sibling command oh revoke.

---

oh grant privilege NAME

Grants one or more privileges on the object NAME, or on every child of a container.

Flags

Flag	Required	Description
--privilege PRIVILEGE	Yes	Privilege (repeatable), e.g. SELECT, INSERT, MANAGE. Grade roles — viewer, editor, user, manager — must be granted on their own.
--on OBJECT_TYPE	One of --on / --on-all	Type of the object NAME (e.g. TABLE, DATABASE, LAKE)
--on-all CHILD_TYPE	One of --on / --on-all	Every current and future child of the container NAME (tables or databases)
--in CONTAINER_TYPE	With --on-all	Container type: database for --on-all tables, lake for --on-all databases
--user / --group / --service-principal	Yes	Principal

Group principals

The server looks up a --group within the project only. Grant the group a project role (oh grant role) first, otherwise the command fails with Entity of type: GROUP not found.

# SELECT on one table
oh grant privilege my-lake.events.clicks \
  --privilege SELECT --on TABLE \
  --user alice@example.com

# SELECT and INSERT on every table in a database
oh grant privilege my-lake.events \
  --privilege SELECT --privilege INSERT \
  --on-all tables --in database \
  --group analytics

# EDITOR grade role (must be granted alone)
oh grant privilege my-lake.events \
  --privilege editor --on DATABASE \
  --user alice@example.com

---

oh grant role ROLE NAME

Grants a role (admin, member or reader) on the project or account NAME.

Flag	Required	Description
--on	Yes	PROJECT or ACCOUNT. --on ACCOUNT only works with --service-principal and the server ignores NAME.
--user / --group / --service-principal	Yes	Principal

oh grant role admin my-project --on PROJECT --user alice@example.com
oh grant role member my-project --on PROJECT --group analytics
oh grant role admin ignored    --on ACCOUNT --service-principal ci-bot

---

oh grant member NAME

Adds a principal as member (default) or manager of the group or service principal NAME.

Flag	Required	Description
--on	Yes	GROUP or SERVICE_PRINCIPAL
--role	No	member (default) or manager
--user / --group / --service-principal	Yes	Principal to add

Allowed principal types

• --on GROUP takes --user or --service-principal.
• --on SERVICE_PRINCIPAL takes --user or --group.

oh grant member analytics --on GROUP --user alice@example.com
oh grant member analytics --on GROUP --service-principal ci-bot --role manager
oh grant member ci-bot    --on SERVICE_PRINCIPAL --group analytics

---

oh grant row-filter EXPRESSION

Restricts the principal to only see rows of --table that match EXPRESSION.

Flag	Required	Description
--table	Yes	Fully-qualified table (lake.database.table)
--user / --group / --service-principal	Yes	Principal

oh grant row-filter "region = 'EU'" \
  --table my-lake.events.clicks \
  --user alice@example.com

---

oh grant column-mask COLUMN

Masks COLUMN of --table for the principal. Exactly one of --mask-type or --custom is required.

Flag	Required	Description
--table	Yes	Fully-qualified table
--mask-type	One of --mask-type / --custom	Built-in mask (e.g. mask-hash, mask-show-last-4)
--custom EXPRESSION	One of --mask-type / --custom	Custom mask expression
--user / --group / --service-principal	Yes	Principal

oh grant column-mask ssn \
  --table my-lake.customers.profiles \
  --mask-type mask-show-last-4 \
  --user alice@example.com

oh grant column-mask email \
  --table my-lake.customers.profiles \
  --custom "regexp_replace(email, '.+@', '***@')" \
  --group analytics

---

oh grant column-access COLUMN...

Restricts the principal to only see the listed columns of --table. Columns may be space-separated or comma-separated.

Flag	Required	Description
--table	Yes	Fully-qualified table
--user / --group / --service-principal	Yes	Principal

oh grant column-access id event_time region \
  --table my-lake.events.clicks \
  --group analytics

oh grant column-access "id,event_time,region" \
  --table my-lake.events.clicks \
  --user alice@example.com

---

oh grant data-admin

Grants DATA_ADMIN, which is organisation-wide and takes no object.

Flag	Required	Description
--user / --group / --service-principal	Yes	Principal

oh grant data-admin --user alice@example.com

---

oh grant show NAME

Lists the grants on the object NAME.

Flag	Required	Description
--on	Yes	Type of the object NAME

oh grant show my-lake.events.clicks --on TABLE

---

oh grant show-roles NAME

Lists the roles a type of principal holds on the project NAME.

Flag	Required	Description
--principal-type	Yes	USER, GROUP or SERVICE_PRINCIPAL
--on	No	Object type (defaults to PROJECT)

oh grant show-roles my-project --principal-type USER
oh grant show-roles my-project --principal-type GROUP