Skip to main content
This feature is in public preview.
A grant assigns a role to a user or token within a workspace or across the organization.

​
Granting access to a user

Grant a role directly to a user by their email.
Alice now has admin access to the production workspace.

​
Organization-wide grants

Use --org to grant a role across all workspaces in the organization.
Alice now has admin access to every workspace in the organization.

​
Listing grants

List all grants in the organization.
Filter by workspace or by user. Unlike sf grants create, which accepts an email, the --user filter takes a user ID.

​
Deleting a grant

Delete a grant by its ID, which sf grants list prints in the first column.
You can also delete a workspace-scoped grant by its attributes. As with sf grants list, --user takes a user ID.
Delete an organization-wide grant.

​
Multiple grants

A user or token can have multiple grants. SF Compute combines the permissions from every granted role (a union).
Bob has viewer access organization-wide and training-operator access in production.

​
Token grants

Grant roles to tokens for CI/CD pipelines and other automation.
Alternatively, assign a role when creating the token.
sf tokens create creates 1 grant per role with no workspace scope, so these grants apply organization-wide. To scope a token’s role to a single workspace, create the grant explicitly with sf grants create --token and --workspace. See Tokens.

​
How grants interact with roles

Grants bind users or tokens to roles. Roles define which actions a user or token can perform. When a request arrives, SF Compute collects every grant the user or token holds on the target workspace, including organization-wide grants. It then evaluates the rules from all matched roles. See Roles for the rule effects and evaluation semantics.

​
API reference

See the Grants API for programmatic access.