Skip to main content
This feature is in public preview.
A grant assigns a role to a user or token within a workspace or across the organization.

​
Granting access to a user

Grant a role directly to a user by their email.
Alice now has admin access to the production workspace. As with other commands, -w and SF_WORKSPACE also set the workspace. --org overrides SF_WORKSPACE, and can’t be combined with -w or --workspace.

​
Organization-wide grants

Use --org to grant a role across all workspaces in the organization.
Alice now has admin access to every workspace in the organization.

​
Listing grants

List all grants in the organization. With a workspace set by -w or SF_WORKSPACE, the list shows only the grants scoped to that workspace, not organization-wide ones.
Filter by workspace or by user. Unlike sf grants create, which accepts an email, the --user filter takes a user ID.

​
Deleting a grant

Delete a grant by its ID, which sf grants list prints in the first column.
You can also delete a workspace-scoped grant by its attributes. As with sf grants list, --user takes a user ID.
Delete an organization-wide grant.

​
Multiple grants

A user or token can have multiple grants. SF Compute combines the permissions from every granted role (a union).
Bob has viewer access organization-wide and training-operator access in production.

​
Token grants

Grant roles to tokens for CI/CD pipelines and other automation.
Alternatively, assign a role when creating the token. sf tokens create takes the same --workspace and --org flags and creates 1 grant per role.
See Tokens.

​
How grants interact with roles

Grants bind users or tokens to roles. Roles define which actions a user or token can perform. When a request arrives, SF Compute collects every grant the user or token holds on the target workspace, including organization-wide grants. It then evaluates the rules from all matched roles. See Roles for the rule effects and evaluation semantics.

​
API reference

See the Grants API for programmatic access.