Object-level privileges

This list describes the object-level privileges in SQL Anywhere. You can view the roles and privileges that a user has in Sybase Central by clicking them and viewing the details that are displayed. You can also retrieve the details by using the sp_has_role system procedure. See Viewing the roles and privileges for a user or role (Sybase Central) and Viewing the roles and privileges for a user or role (SQL).

Privilege name	Supported by database objects	Inherited through group membership?	WITH GRANT OPTION allowed when granting?	Description
ALL	Tables, views	Yes	Yes	Allows a user to perform all tasks associated with the database object. This privilege grants the following privileges on tables: ALTER, DELETE, INSERT, REFERENCES, SELECT, and UPDATE. This privilege grants the following privileges on views: DELETE, INSERT, SELECT, and UPDATE. Granting ALL also grants LOAD and TRUNCATE privileges.
ALTER	Tables	Yes	Yes	Allows a user to alter the structure of a table or create a trigger on the table. Because this privilege grants the user the privilege to modify the database schema, it should not be granted to most users.
CONNECT	Databases	No	No	Allows a user to connect to the current database.
CONSOLIDATE	Users	No	No	Allows a user to identify a consolidated database in SQL Remote.
CREATE ON	Dbspaces	Yes	Yes	Allows a user to create on the dbspace. The additional privileges required depend on the object that is being created. For example, to create a table, one of CREATE TABLE, CREATE ANY TABLE, or CREATE ANT OBJECT is required.
DELETE	Tables, views	No	Yes	Allows a user to delete rows from the table or view.
EXECUTE	Triggers, procedures, user-defined functions	No	No	Allows a user to execute the procedure or user-defined function.
INSERT	Tables, views	Yes	Yes	Allows a user to insert rows into the table or view.
INTEGRATED LOGIN	Databases	No	No	Allows a user to connect to the current database using an integrated login.
KERBEROS LOGIN	Databases	No	No	Allows a user to connect to the current database using a Kerberos login.
LOAD	Tables	Yes	Yes	Allows a user to load the table if the -gl database option is set to anything other than NONE.
PUBLISH	Users	No	No	Identifies the user ID for a database in SQL Remote.
REFERENCES	Tables	Yes	Yes	Allows a user to create indexes on the table and to create foreign keys that reference the table. This privilege can also be granted on individual columns in a table. Because this privilege allows the user to modify the database schema, it should not be granted to most users. When the column names are specified, the user is only allowed to index those columns in the table.
REMOTE	Users	No	No	Allows a user to identify a remote database in SQL Remote and MobiLink.
SELECT	Tables, views	Yes	Yes	Allows a user to query the table or a view. This privilege can also be granted to individual columns in a table. When the column names are specified, the user is only allowed to view those columns in the table.
TRUNCATE	Tables, materialized views	Yes	Yes	Allows a user to truncate the table or materialized view.
UPDATE	Tables, views	Yes	Yes	Allows a user to update rows in the table or view. This privilege can also be granted to individual columns in a table.
USAGE	Sequence generators	No	Yes	Allows a user to evaluate the current or next value in the sequence.

Additional notes

The WITH GRANT OPTION is not inherited by group members While some object-level privileges are inheritable, the WITH GRANT OPTION is never inheritable. For example, if a user-extended role, UserA, is granted SELECT on a table and the WITH GRANT OPTION is specified, then UserA can select on the table, and grant select on that table to others. Grantees of that user-extended role inherit the ability to select from the table, but do not inherit the ability to grant the SELECT privilege to others.
Views You can grant privileges on disabled views. Privileges for disabled views are stored in the database and become effective when the view is enabled.
Procedures A user must own a procedure, or have EXECUTE privilege on it, to execute it.
Additionally, if the procedure definition includes SQL SECURITY DEFINER, the procedure runs with the privileges of the procedure owner, not the user calling the procedure. If the procedure definition includes SQL SECURITY INVOKER, then the procedure runs with the privileges that the invoker has.
dbspaces Any user that is granted the CREATE ON privilege on dbspaces must also have the appropriate CREATE privilege to create the objects they want to create.
Sequences The USAGE privilege is the only privilege that is granted on sequence generators. This privilege allows users to evaluate the current or next value in a sequence. If the sequence is part of a DEFAULT clause on a table, any user that inserts a row into the table must have privilege on the sequence.

Object-level privileges

Additional notes

See also