> ## Documentation Index > Fetch the complete documentation index at: https://firebolt-aggregate-helm-docs-pr-97.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. > Learn about account-level permissions in Firebolt. # Account Permissions Account-level permissions apply to the whole Firebolt deployment rather than to one object: each covers every current and future database, location, role or user of its kind. They are granted and revoked without an `ON` clause. | Privilege | Description | GRANT Syntax | REVOKE Syntax | | ----------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------- | ----------------------------------------- | | CREATE DATABASE | Allows creating new databases in an account. | `GRANT CREATE DATABASE TO ;` | `REVOKE CREATE DATABASE FROM ;` | | USAGE ANY DATABASE | Allows using all current and future databases in an account. | `GRANT USAGE ANY DATABASE TO ;` | `REVOKE USAGE ANY DATABASE FROM ;` | | MODIFY ANY DATABASE | Allows editing all current and future databases in an account. | `GRANT MODIFY ANY DATABASE TO ;` | `REVOKE MODIFY ANY DATABASE FROM ;` | | [CREATE ENGINE](/reference-sql/commands/engines/create-engine) | Allows creating new engines in an account. | `GRANT CREATE ENGINE TO ;` | `REVOKE CREATE ENGINE FROM ;` | | USAGE ANY ENGINE | Allows using all current and future engines in an account. | `GRANT USAGE ANY ENGINE TO ;` | `REVOKE USAGE ANY ENGINE FROM ;` | | OPERATE ANY ENGINE | Allows starting and stopping all current and future engines in the account. | `GRANT OPERATE ANY ENGINE TO ;` | `REVOKE OPERATE ANY ENGINE FROM ;` | | MODIFY ANY ENGINE | Allows editing all current and future engines in the account. | `GRANT MODIFY ANY ENGINE TO ;` | `REVOKE MODIFY ANY ENGINE FROM ;` | | MONITOR \[ANY USAGE] | Enables the tracking of engine queries through the `engine_running_queries` view for active queries and the `engine_query_history` view for past queries in `information_schema`. | `GRANT MONITOR ANY USAGE TO ;` | `REVOKE MONITOR ANY USAGE FROM ;` | | [CREATE ROLE](/reference-sql/commands/access-control/create-role) | Allows creating new roles in the account. | `GRANT CREATE ROLE TO ;` | `REVOKE CREATE ROLE FROM ;` | | MODIFY ANY ROLE | Allows editing all current and future roles in the account. | `GRANT MODIFY ANY ROLE TO ;` | `REVOKE MODIFY ANY ROLE FROM ;` | | [CREATE USER](/reference-sql/commands/access-control/create-user) | Allows creating new users in the account. | `GRANT CREATE USER TO ;` | `REVOKE CREATE USER FROM ;` | | MODIFY ANY USER | Allows editing all current and future users in the account. | `GRANT MODIFY ANY USER TO ;` | `REVOKE MODIFY ANY USER FROM ;` | | CREATE LOCATION | Allows creating new location objects in the account. | `GRANT CREATE LOCATION TO ;` | `REVOKE CREATE LOCATION FROM ;` | | MODIFY ANY LOCATION | Allows editing all current and future locations in the account. | `GRANT MODIFY ANY LOCATION TO ;` | `REVOKE MODIFY ANY LOCATION FROM ;` | | USAGE ANY LOCATION | Allows using all current and future locations in the account. | `GRANT USAGE ANY LOCATION TO ;` | `REVOKE USAGE ANY LOCATION FROM ;` | | ALL \[PRIVILEGES] | Grants every account-level privilege to a specified role. | `GRANT ALL TO ;` | `REVOKE ALL FROM ;` | Revoking a privilege removes it from a role but does not explicitly deny the privilege. If the privilege was not previously granted, revoking it has no effect. For more detailed information about location permissions and their usage, see [Location permissions](/security/rbac/location-permissions). ## Examples of granting account-level permissions ### CREATE DATABASE permission The following code example [grants](/reference-sql/commands/access-control/grant) the role `developer_role` permission to create new databases: ```sql theme={"theme":{"light":"css-variables","dark":"css-variables"}} GRANT CREATE DATABASE TO developer_role; ``` ### USAGE ANY DATABASE permission The following code example gives permission to the role `developer_role` to access all current and future databases: ```sql theme={"theme":{"light":"css-variables","dark":"css-variables"}} GRANT USAGE ANY DATABASE TO developer_role; ``` ### MODIFY ANY DATABASE permission The following code example grants the role `developer_role` permission to modify or delete all current and future databases: ```sql theme={"theme":{"light":"css-variables","dark":"css-variables"}} GRANT MODIFY ANY DATABASE TO developer_role; ``` ### [CREATE ENGINE](/reference-sql/commands/engines/create-engine) permission The following code example gives the role `developer_role` permission to create new engines: ```sql theme={"theme":{"light":"css-variables","dark":"css-variables"}} GRANT CREATE ENGINE TO developer_role; ``` ### USAGE ANY ENGINE permission The following code example grants the role `developer_role` permission to use all current and future engines: ```sql theme={"theme":{"light":"css-variables","dark":"css-variables"}} GRANT USAGE ANY ENGINE TO developer_role; ``` ### OPERATE ANY ENGINE permission The following code example gives the role `developer_role` permission to start and stop all current and future engines: ```sql theme={"theme":{"light":"css-variables","dark":"css-variables"}} GRANT USAGE ANY DATABASE TO developer_role; ``` ### MODIFY ANY ENGINE permission The following code example grants the role `developer_role` permission to modify or delete all current and future engines: ```sql theme={"theme":{"light":"css-variables","dark":"css-variables"}} GRANT MODIFY ANY ENGINE TO developer_role; ``` ### [CREATE ROLE](/reference-sql/commands/access-control/create-role) permission The following code example gives the role `developer_role` permission to create new roles: ```sql theme={"theme":{"light":"css-variables","dark":"css-variables"}} GRANT CREATE ROLE TO developer_role; ``` ### MODIFY ANY ROLE permission The following code example grants the role `developer_role` permission to modify or delete all current and future roles: ```sql theme={"theme":{"light":"css-variables","dark":"css-variables"}} GRANT MODIFY ANY ROLE TO developer_role; ``` ### [CREATE USER](/reference-sql/commands/access-control/create-user) permission The following code example gives the role `developer_role` permission to create new users: ```sql theme={"theme":{"light":"css-variables","dark":"css-variables"}} GRANT CREATE USER TO developer_role; ``` ### MODIFY ANY USER permission The following code example grants the role `developer_role` permission to modify or delete all current and future users: ```sql theme={"theme":{"light":"css-variables","dark":"css-variables"}} GRANT MODIFY ANY USER TO developer_role; ``` ### MONITOR \[ANY USAGE] permission The following code example grants the role `developer_role` permission to see the query history and currently running queries on all the engines: ```sql theme={"theme":{"light":"css-variables","dark":"css-variables"}} GRANT MONITOR ANY USAGE TO developer_role; ``` ### CREATE LOCATION permission The following code example grants role `my_role` permission to create locations: ```sql theme={"theme":{"light":"css-variables","dark":"css-variables"}} -- Grant ability to create new locations GRANT CREATE LOCATION TO my_role; ``` ### MODIFY ANY LOCATION permission The following code example grants role `my_role` permission to modify or delete all current and future locations: ```sql theme={"theme":{"light":"css-variables","dark":"css-variables"}} -- Grant ability to create new locations GRANT MODIFY ANY LOCATION TO my_role; ``` ### USAGE ANY LOCATION permission The following code example grants role `my_role` permission to use all current and future locations: ```sql theme={"theme":{"light":"css-variables","dark":"css-variables"}} -- Grant ability to create new locations GRANT USAGE ANY LOCATION TO my_role; ```