SHOW roles and membership
Marked preset roles include the permission by default; a custom role qualifies when it inherits a role that includes it. Applies to inspecting other members and roles; without it, users can inspect only roles they belong to and their own assignments. SHOW ALL ROLES needs no permission.
These read-only commands report the state of roles and membership. They do not change any access. Listing a role name does not grant access to it. See Roles and access control for the model.
The OF and TO keywords set the direction of the lookup:
OF ROLEwalks down: the users and roles that hold the role.TO ROLEandTO USERwalk up: the roles a role or user inherits, transitively.
SHOW ALL ROLES​
List every role in the organization, both preset and custom. Any member can run this command and sees role names only, with no membership details.
SHOW ALL ROLES;
Output columns:
| Column | Description |
|---|---|
role_name | Name of the role. |
role_type | preset or custom. |
included_roles | The roles this role inherits directly. |
created_at | When the role was created. |
SHOW USERS OF ROLE​
List the users and service accounts that hold a role directly.
SHOW USERS OF ROLE finance;
Output columns:
| Column | Description |
|---|---|
username | Member or service account name. |
email | Member email. |
is_service_account | true for a service account. |
granted_at | When the role was assigned. |
SHOW ROLES OF ROLE​
List the roles that hold a role directly, that is, the roles that inherit from it.
SHOW ROLES OF ROLE finance;
Output columns:
| Column | Description |
|---|---|
role_name | Name of a role that inherits this role. |
role_type | preset or custom. |
granted_at | When the inheritance was established. |
SHOW ROLES TO ROLE​
List the roles a role inherits, walking up the hierarchy transitively.
SHOW ROLES TO ROLE finance;
Output columns:
| Column | Description |
|---|---|
role_name | Name of an inherited role. |
role_type | preset or custom. |
is_direct | true when the role is inherited directly, false when inherited through another role. |
granted_at | When a direct inheritance was established. NULL for a transitively inherited role. |
SHOW ROLES TO USER​
List every role assigned to a user, walking up the hierarchy transitively. Useful for auditing what a user can access.
SHOW ROLES TO USER alice;
Output columns:
| Column | Description |
|---|---|
role_name | Name of an assigned role. |
role_type | preset or custom. |
is_direct | true when the role is assigned directly, false when inherited through another role. |
granted_at | When a direct assignment was made. NULL for a transitively inherited role. |