# Is it possible to give a none superuser a near superuser role?

**URL:** <https://forum.yugabyte.com/t/is-it-possible-to-give-a-none-superuser-a-near-superuser-role/440>\
**Category:** General\
**Created:** [July 16, 2019, 12:13am UTC](https://forum.yugabyte.com/t/is-it-possible-to-give-a-none-superuser-a-near-superuser-role/440 "2019-07-16T00:13:07Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Steve\_Liang](https://yyz1.discourse-cdn.com/flex027/user_avatar/forum.yugabyte.com/steve_liang/32/112_2.png) [@Steve\_Liang](https://forum.yugabyte.com/u/Steve_Liang)\
**Post date:** [July 16, 2019, 12:13am UTC](https://forum.yugabyte.com/t/is-it-possible-to-give-a-none-superuser-a-near-superuser-role/440/1 "2019-07-16T00:13:07Z")

</div>

According to this doc:

> **[YugabyteDB docs archive](https://docs-archive.yugabyte.com/)**
>
> Documentation for EOL YugabyteDB versions

You can either set the is\_superuser flag true or false. Suppose I want a near superuser role, create user, create keyspace, grant user read/write/update to keyspaces, but this user can not drop keyspaces or grant other users drop keyspaces.

Is this possible?

---

<div class="post-metadata">

**Author:** ![kannan](https://yyz1.discourse-cdn.com/flex027/user_avatar/forum.yugabyte.com/kannan/32/18_2.png) [@kannan](https://forum.yugabyte.com/u/kannan)\
**Post date:** [July 16, 2019, 12:44am UTC](https://forum.yugabyte.com/t/is-it-possible-to-give-a-none-superuser-a-near-superuser-role/440/2 "2019-07-16T00:44:56Z")

</div>

@hector - can you please take a look at above question?

---

<div class="post-metadata">

**Author:** ![Alan\_Caldera](https://yyz1.discourse-cdn.com/flex027/user_avatar/forum.yugabyte.com/alan_caldera/32/91_2.png) [@Alan\_Caldera](https://forum.yugabyte.com/u/Alan_Caldera)\
**Post date:** [July 16, 2019, 12:48am UTC](https://forum.yugabyte.com/t/is-it-possible-to-give-a-none-superuser-a-near-superuser-role/440/3 "2019-07-16T00:48:04Z")

</div>

Steve ,  
Yes it is possible to create a user (ROLE) with that permission set. If you examine the [GRANT PERMISSION](https://docs.yugabyte.com/latest/api/ycql/ddl_grant_permission/) command you can customize the list of permissions that a role may have.

E.g.

```auto
CREATE ROLE near_superuser;
GRANT CREATE ON ALL ROLES TO near_superuser;
GRANT CREATE ON ALL KEYSPACES TO near_superuser;
GRANT MODIFY ON ALL KEYSPACES TO near_superuser;
GRANT SELECT ON ALL KEYSPACES TO near_superuser;

```

Hope this helps.  
–Alan