> For the complete documentation index, see [llms.txt](https://docs.starrocks.io/llms.txt). This page is also available as Markdown at its `.md` URL.

# Built-in Roles supported by StarRocks

In a StarRocks cluster, there are FIVE built-in roles:

* `db_admin`
* `cluster_admin`
* `user_admin`
* `security_admin`
* `public`

Each of the `admin` roles is granted with different privileges to allow them to perform administrative operations on their specific domain. By default, the `public` role has no privileges and is granted to every user that can access the cluster.

For details of the privileges described below, see [Privilege Item](https://docs.starrocks.io/docs/administration/user_privs/authorization/privilege_item.md).

## `db_admin`[​](#db_admin "Direct link to db_admin")

`db_admin` is the built-in database administrator. It has all data-related privileges and some basic privileges on operations and maintenance.

* Focused on management of databases and data
* Unavailable for user or cluster management
* Immutable role

Privilege scope:

| Privilege Level   | Privilege Item                                                                                                                                                                                                                       |
| ----------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| SYSTEM            | - CREATE RESOURCE<br />- PLUGIN<br />- FILE<br />- BLACKLIST<br />- OPERATE<br />- CREATE EXTERNAL CATALOG<br />- REPOSITORY<br />- CREATE RESOURCE GROUP<br />- CREATE GLOBAL FUNCTION<br />- CREATE STORAGE VOLUME<br />- SECURITY |
| CATALOG           | - USAGE<br />- DROP<br />- ALTER<br />- CREATE DATABASE                                                                                                                                                                              |
| DATABASE          | - DROP<br />- ALTER<br />- CREATE TABLE<br />- CREATE VIEW<br />- CREATE MATERIALIZED VIEW<br />- CREATE FUNCTION<br />- CREATE PIPE<br />- CREATE MASKING POLICY<br />- CREATE ROW ACCESS POLICY                                    |
| TABLE             | - DROP<br />- ALTER<br />- INSERT<br />- UPDATE<br />- DELETE<br />- SELECT<br />- EXPORT                                                                                                                                            |
| VIEW              | - DROP<br />- ALTER<br />- SELECT                                                                                                                                                                                                    |
| MATERIALIZED VIEW | - DROP<br />- ALTER<br />- SELECT<br />- REFRESH                                                                                                                                                                                     |
| RESOURCE          | - USAGE<br />- DROP<br />- ALTER                                                                                                                                                                                                     |
| RESOURCE GROUP    | - DROP<br />- ALTER                                                                                                                                                                                                                  |
| FUNCTION          | - USAGE<br />- DROP                                                                                                                                                                                                                  |
| GLOBAL FUNCTION   | - USAGE<br />- DROP                                                                                                                                                                                                                  |
| STORAGE VOLUME    | - USAGE<br />- DROP<br />- ALTER                                                                                                                                                                                                     |
| PIPE              | - USAGE<br />- DROP<br />- ALTER                                                                                                                                                                                                     |

## `cluster_admin`[​](#cluster_admin "Direct link to cluster_admin")

`cluster_admin` is the built-in cluster administrator.

* Focused on management of cluster infrastructure
* Granted with privileges on node management
* Immutable role

Privilege scope:

| Privilege Level | Privilege Item |
| --------------- | -------------- |
| SYSTEM          | NODE           |

## `user_admin`[​](#user_admin "Direct link to user_admin")

`user_admin` is the built-in user administrator. It can be used to manage users, roles, and authorization.

* Focused on management of users and privileges
* Able to create, alter, and drop users
* Able to grant or revoke privileges or roles
* Immutable role

Privilege scope:

| Privilege Level | Privilege Item |
| --------------- | -------------- |
| SYSTEM          | GRANT          |

## `security_admin`[​](#security_admin "Direct link to security_admin")

`security_admin` is the built-in security administrator. It can be used to manage security integrations and group providers.

* Focused on management of system security
* Able to manage security-related configurations and strategies
* Immutable role

Privilege scope:

| Privilege Level | Privilege Item            |
| --------------- | ------------------------- |
| SYSTEM          | - SECURITY<br />- OPERATE |

## `public`[​](#public "Direct link to public")

`public` is the built-in role that is granted to every user that can access the cluster. By default, it has no privilege.

* Automatically granted and activated to all cluster users
* Mutable role. You can grant privileges or roles to this role if you want to grant them to all cluster users.