The RESTRICT command does not apply to an account with the SUPERUSER role. The SUPERUSER role always has full read/write access to the database. Do not assign SUPERUSER to any role that you might want to restrict.

Use RESTRICT to deny access to a role on a data resource (keyspace or table). RESTRICT denies access even if permission to access the resource has been granted or inherited.

This command is useful when you want to restrict a role from accessing a specific resource, even if the role has been granted access to the resource. For example, you may want to restrict a role from accessing a specific table in a keyspace, even if the role has been granted access to the keyspace.

RESTRICT permission always take precedence over GRANT permissions.


RESTRICT <permission> ON [<keyspace_name>.]<table_name> TO <role_name> ;
Syntax legend
Syntax conventions Description


Literal keyword.


Not literal.

< >

Variable value. Replace with a user-defined value.


Optional. Square brackets ([]) surround optional command arguments. Do not type the square brackets.

( )

Group. Parentheses ( ( ) ) identify a group to choose from. Do not type the parentheses.


Or. A vertical bar (|) separates alternative elements. Type any one of the elements. Do not type the vertical bar.


Repeatable. An ellipsis ( ... ) indicates that you can repeat the syntax element as often as required.

'<Literal string>'

Single quotation (') marks must surround literal strings in CQL statements. Use single quotation marks to preserve upper case.

{ <key> : <value> }

Map collection. Braces ({ }) enclose map collections or key value pairs. A colon separates the key and the value.


Set, list, map, or tuple. Angle brackets ( < > ) enclose data types in a set, list, map, or tuple. Separate the data types with a comma.


End CQL statement. A semicolon (;) terminates all CQL statements.


Separate the command line options from the command arguments with two hyphens ( -- ). This syntax is useful when arguments might be mistaken for command line options.

' <<schema\> ... </schema\>> '

Search CQL only: Single quotation marks (') surround an entire XML schema declaration.


Search CQL only: Identify the entity and literal value to overwrite the XML element in the schema and solrConfig files.


A comma separated list of permissions that the role is prevented from using on the resources even if the permissions is granted. Where the permission types are: ALL PERMISSIONS or ALTER, AUTHORIZE [FOR permission_list], CREATE, DESCRIBE, DROP, MODIFY (deprecated), SELECT, TRUNCATE, or UPDATE (allows INSERT, UPDATE, or DELETE).


Database object to which the permission is denied. Restriction is applied using modeled hierarchy as follows:

  • ALL KEYSPACES - restricts access to every keyspace and table.

  • KEYSPACE <keyspace_name> - restricts access on the keyspace and any table it contains

  • TABLE <table_name> - restricts access on the table and all the data it contains


Prevent the role admin from seeing any data in the cycling keyspace:


Was this helpful?

Give Feedback

How can we improve the documentation?

© 2024 DataStax | Privacy policy | Terms of use

Apache, Apache Cassandra, Cassandra, Apache Tomcat, Tomcat, Apache Lucene, Apache Solr, Apache Hadoop, Hadoop, Apache Pulsar, Pulsar, Apache Spark, Spark, Apache TinkerPop, TinkerPop, Apache Kafka and Kafka are either registered trademarks or trademarks of the Apache Software Foundation or its subsidiaries in Canada, the United States and/or other countries. Kubernetes is the registered trademark of the Linux Foundation.

General Inquiries: +1 (650) 389-6000,