Warehouse Users and Roles

Use Warehouse Users and Roles to manage users, roles, and permissions for a warehouse. Applications, BI tools, and SQL clients use these accounts to connect to the warehouse. They are distinct from the accounts used to sign in to the VeloDB Console. Roles defined here are SQL roles scoped to the warehouse, not the organization roles managed in Members.

In the left navigation, click More, then click User and Roles.

Note For organization members and their console roles (Organization Admin, Warehouse Admin, Warehouse Viewer), see Members.

Users

The Users page lists the warehouse users. The built-in root user is hidden from this page.

Only users with the Admin privilege can add or modify other users.

To create a user, complete the following fields:

• Username (required): The warehouse username.
• Password (required): The password used to authenticate the user.
• Host (optional): The source host from which the user can connect. If omitted, it defaults to %, which allows connections from any host.
• Belongs to role (optional): One or more existing roles to assign to the user. You can change role assignments later.

Roles

The Roles page lets you manage roles and their permissions.

Only users with the Admin privilege can add or modify roles.

Note You cannot manage user-to-role assignments from the Roles page. Assign roles when you create or modify a user.

Permissions

Select a user or role name to open its details page, where you can grant or revoke permissions. You must have the Admin or Grant privilege at the corresponding scope.

Permissions are grouped by object type:

Scope	What it covers
Global	Applies to the entire warehouse. A global permission automatically includes the matching permission on every child object.
Data	Permissions on data resources, granted at each scope. A grant on a parent object automatically includes the matching permission on its child objects.
Workload Group	Usage permission only.
Resource	Grant and Usage permissions on a resource.
Compute Group	Usage permission on a compute group (clusters with isolated memory in VeloDB 3.0 and later).
Cluster	Usage permission per cluster (for connection-level access control).