Skip to main content
This feature is in public preview.
A grant assigns a role to a user or token within a workspace or across the entire organization.

​
Granting access to a user

Grant a role directly to a user by their email.
Alice now has admin access to the production workspace.

​
Organization-wide grants

Use --org to grant a role across all workspaces in the organization.
Alice now has admin access to every workspace in the organization.

​
Listing grants

List all grants in the organization:
Filter by workspace or by user:

​
Removing a grant

Remove a workspace-scoped grant:
Remove an organization-wide grant:

​
Multiple grants

A user or token can have multiple grants. Permissions are combined (union of all roles).
Bob has viewer access organization-wide and training-operator access in production.

​
Token grants

Tokens can also be granted roles. This is useful for CI/CD pipelines and automation.
Alternatively, assign a role when creating the token. sf tokens create creates one grant per role with no workspace scope, so these grants apply organization-wide. To scope a token’s role to a single workspace, create the grant explicitly with sf grants create --token and --workspace. See Tokens.

​
How grants interact with roles

Grants bind users or tokens to roles. Roles define what actions are allowed. The evaluation order is:
  1. Collect all grants for the user or token on the target workspace (including organization-wide grants).
  2. Collect all rules from all matched roles.
  3. If any rule allows the action, allow.
  4. Otherwise, deny.