---
metadata:
  - name: generator
    content: Diplodoc Platform v5.56.0
alternate:
  - https://ydb.tech/docs/en/yql/reference/syntax/alter-group.md?version=v26.2
  - https://ydb.tech/docs/ru/yql/reference/syntax/alter-group.md?version=v26.2
  - href: en/yql/reference/syntax/alter-group.md
    type: text/markdown
    title: Markdown version
  - href: ../../../llms.txt
    type: text/markdown
    title: llms.txt
sourcePath: en/core/yql/reference/syntax/alter-group.md
---
> **Documentation Index:** Fetch the complete configuration index at https://ydb.tech/docs/en/llms.txt

# ALTER GROUP

Adds/removes the group to/from a specific user. You can list multiple users under one operator.

Syntax:

```yql
ALTER GROUP role_name ADD USER user_name [, ... ]
ALTER GROUP role_name DROP USER user_name [, ... ]
```

* `role_name`: The name of the group.
* `user_name`: The name of the user.

<!-- source: en/yql/reference/_includes/builtin_groups.md -->
## Built-in groups {#builtin}

The YDB cluster has built-in groups providing predefined role sets:

| Group              | Description                                                                                   |
|--------------------|-----------------------------------------------------------------------------------------------|
| `ADMINS`           | Unlimited rights over the entire cluster schema                                               |
| `DATABASE-ADMINS`  | Rights to create and delete databases (`CreateDatabase`, `DropDatabase`)                      |
| `ACCESS-ADMINS`    | Rights to manage other users' permissions (`GrantAccessRights`)                               |
| `DDL-ADMINS`       | Rights to alter database schemas (`CreateDirectory`, `CreateTable`, `WriteAttributes`, `AlterSchema`, `RemoveSchema`) |
| `DATA-WRITERS`     | Rights to modify data (`UpdateRow`, `EraseRow`)                                               |
| `DATA-READERS`     | Rights to read data (`SelectRow`)                                                             |
| `METADATA-READERS` | Rights to read metadata, without access to data (`DescribeSchema` and `ReadAttributes`)       |
| `USERS`            | Rights to connect to databases (`ConnectDatabase`)                                           |

By default, all users are included in the `USERS` group, and the `root` user is included in the `ADMINS` group.

Below is a diagram demonstrating how groups inherit permissions from each other. For example, `DATA-WRITERS` includes all permissions of `DATA-READERS`:

![builtin_groups](../_assets/builtin_groups.svg)
<!-- endsource: en/yql/reference/_includes/builtin_groups.md -->