> ## Documentation Index
> Fetch the complete documentation index at: https://docs.turso.tech/llms.txt
> Use this file to discover all available pages before exploring further.

# Fine-Grained Permissions

Fine-grained permissions let you control access at the table and action level. They work with both [CLI-generated tokens](/sdk/authorization/tokens) and [JWKS-issued tokens](/sdk/authorization/jwks).

## Permission Format

Permissions follow the format `<table-name|all>:<action1>,<action2>`:

```bash theme={null}
# Read-only access to all tables
turso db tokens create mydb -p all:data_read

# Specific actions on a specific table
turso db tokens create mydb -p users:data_read,data_update

# Multiple permission rules
turso db tokens create mydb \
  -p all:data_read \
  -p comments:data_add,data_update \
  -p posts:data_add,data_update,data_delete
```

Use `all` as the table name to apply permissions to every table.

## Available Actions

| Action | Description |
| - | - |
| `data_read` | Read data from tables |
| `data_add` | Insert new rows |
| `data_update` | Update existing rows |
| `data_delete` | Delete rows |
| `schema_add` | Create new tables |
| `schema_update` | Modify table schemas |
| `schema_delete` | Drop tables |

<Note>
  `data_read` is allowed on SQLite system tables (e.g., `sqlite_master`,
  `sqlite_schema`) by default, allowing users to query database metadata.
</Note>

## Role-Based Access Example

You can configure your JWT template to grant different permissions based on user roles:

| Role | Permissions |
| - | - |
| Admin | `all:data_read,data_add,data_update,data_delete,schema_add,schema_update,schema_delete` |
| Moderator | `all:data_read,data_update` |
| User | `all:data_read` |

With JWKS, these permissions are embedded in the JWT token based on user metadata (e.g., role, group membership) from your auth provider.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.