# Authorization (/docs/reference/roles-permissions/authorization)



These permissions govern sharing, not system-role assignments. Tenant membership supplies the ordinary sharing-operation gate; ownership or resource-specific sharing authority decides whether it can be used on a particular resource.

Delegating a grant manager or transferring ownership is supported for Data Hub resources and requires both the corresponding permission and current ownership. A grant manager cannot use that role alone to transfer ownership. MCP servers use tenant administration instead of resource sharing; Skills use their own owner-controlled tenant-sharing model.

## Permissions [#permissions]

This family contains **5 permissions**. “Baseline member” means every current tenant member already has the operation permission, including members with any system role. It does not bypass the resource checks described above. “Custom role” means the identifier can be selected when defining a custom role.

<Catalogue>
  <details className="catalogue-entry">
    <summary>
      ### authorization.resource\_grant.create [#authorizationresource_grantcreate]

      <span className="catalogue-description">
        Share a supported resource with an eligible subject.
      </span>
    </summary>

    <div className="catalogue-content">
      Share a supported resource with an eligible subject. Resource ownership or grant-management authority is still required.

      | Property    | Value                                                                                        |
      | ----------- | -------------------------------------------------------------------------------------------- |
      | Scope       | Selected tenant                                                                              |
      | Granted by  | [Baseline member](/docs/reference/roles-permissions/system-roles#baseline-tenant-membership) |
      | Custom role | No. Resource sharing uses baseline membership plus resource-specific grant checks.           |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### authorization.resource\_grant.delegate [#authorizationresource_grantdelegate]

      <span className="catalogue-description">
        Delegate grant-manager access on supported Data Hub resources.
      </span>
    </summary>

    <div className="catalogue-content">
      Delegate grant-manager access on supported Data Hub resources. The caller must own the resource.

      | Property    | Value                                                                                                                                                    |
      | ----------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
      | Scope       | Selected tenant                                                                                                                                          |
      | Granted by  | [Data Builder](/docs/reference/roles-permissions/system-roles#data-builder), [Data Steward](/docs/reference/roles-permissions/system-roles#data-steward) |
      | Custom role | Yes                                                                                                                                                      |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### authorization.resource\_grant.list [#authorizationresource_grantlist]

      <span className="catalogue-description">
        Inspect sharing grants on a supported resource when the caller has its sharing or grant-management authority.
      </span>
    </summary>

    <div className="catalogue-content">
      Inspect sharing grants on a supported resource when the caller has its sharing or grant-management authority.

      | Property    | Value                                                                                        |
      | ----------- | -------------------------------------------------------------------------------------------- |
      | Scope       | Selected tenant                                                                              |
      | Granted by  | [Baseline member](/docs/reference/roles-permissions/system-roles#baseline-tenant-membership) |
      | Custom role | No. Resource sharing uses baseline membership plus resource-specific grant checks.           |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### authorization.resource\_grant.revoke [#authorizationresource_grantrevoke]

      <span className="catalogue-description">
        Remove a sharing grant on a supported resource.
      </span>
    </summary>

    <div className="catalogue-content">
      Remove a sharing grant on a supported resource. Independent grants and inherited access remain effective.

      | Property    | Value                                                                                        |
      | ----------- | -------------------------------------------------------------------------------------------- |
      | Scope       | Selected tenant                                                                              |
      | Granted by  | [Baseline member](/docs/reference/roles-permissions/system-roles#baseline-tenant-membership) |
      | Custom role | No. Resource sharing uses baseline membership plus resource-specific grant checks.           |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### authorization.resource\_owner.transfer [#authorizationresource_ownertransfer]

      <span className="catalogue-description">
        Transfer ownership of a supported Data Hub resource to an eligible tenant member.
      </span>
    </summary>

    <div className="catalogue-content">
      Transfer ownership of a supported Data Hub resource to an eligible tenant member. The caller must be the current owner.

      | Property    | Value                                                                                                                                                    |
      | ----------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
      | Scope       | Selected tenant                                                                                                                                          |
      | Granted by  | [Data Builder](/docs/reference/roles-permissions/system-roles#data-builder), [Data Steward](/docs/reference/roles-permissions/system-roles#data-steward) |
      | Custom role | Yes                                                                                                                                                      |
    </div>
  </details>
</Catalogue>

## Related pages [#related-pages]

* [Roles and permissions catalogue](/docs/reference/roles-permissions)
* [System roles and baseline access](/docs/reference/roles-permissions/system-roles)