Database, Graph, Label/Type, Procedure, and Other Privileges: Designing Least-Privilege Roles

Learning outcomes

AtlasMart has three service personas: a catalog reader, an order writer and an operations administrator. Giving all three admin is easy, but it destroys the security boundary. This lesson designs the privilege set from required actions and negative tests rather than from built-in role names alone.

Reproducible AtlasMart setup

$env:NEO4J_URI='bolt://127.0.0.1:7687'$env:NEO4J_USER='neo4j'$env:NEO4J_PASSWORD='atlasmart-course-2026'$env:NEO4J_DATABASE='neo4j'py -3 -m venv .venv.\.venv\Scripts\Activate.ps1python -m pip install --upgrade pippython -m pip install neo4j==6.3.0

CYPHER 25CREATE CONSTRAINT customer_id IF NOT EXISTSFOR (c:Customer) REQUIRE c.customerId IS UNIQUE;CREATE CONSTRAINT product_id IF NOT EXISTSFOR (p:Product) REQUIRE p.productId IS UNIQUE;CREATE CONSTRAINT order_id IF NOT EXISTSFOR (o:Order) REQUIRE o.orderId IS UNIQUE;MERGE (c:Customer {customerId:'C-1001'})SET c.name='Mina Rahimi', c.tier='GOLD', c.tenantId='TENANT-A'MERGE (p:Product {productId:'P-1001'})SET p.name='Trail Camera', p.category='Cameras', p.price=129.90MERGE (o:Order {orderId:'O-5001'})SET o.status='PAID', o.tenantId='TENANT-A', o.orderedAt=datetime('2026-09-08T16:30:00Z')MERGE (c)-[:PLACED]->(o)MERGE (o)-[r:CONTAINS]->(p)SET r.quantity=1, r.unitPrice=129.90;

These are course-only credentials and synthetic records. The fixture deliberately includes tenantId because authorization mistakes often appear when a graph traversal crosses a tenant boundary even though authentication succeeded.

1. Start from operations, not role names

Least privilege means the service can complete its contract and nothing more. The test suite must contain denied operations; otherwise “least” is not being verified.

2. Privilege layers in Enterprise/Aura-capable tiers

3. Reader role with an explicit property contract

CREATE ROLE atlasmart_reader IF NOT EXISTS;CREATE USER atlasmart_reader_user IF NOT EXISTSSET PASSWORD $readerPassword CHANGE NOT REQUIRED;GRANT ROLE atlasmart_reader TO atlasmart_reader_user;GRANT ACCESS ON DATABASE neo4j TO atlasmart_reader;GRANT MATCH {customerId, name, tier, tenantId}  ON GRAPH neo4j NODES Customer TO atlasmart_reader;GRANT MATCH {orderId, status, orderedAt, tenantId}  ON GRAPH neo4j NODES Order TO atlasmart_reader;GRANT MATCH {productId, name, category, price}  ON GRAPH neo4j NODES Product TO atlasmart_reader;GRANT MATCH {*}  ON GRAPH neo4j RELATIONSHIPS PLACED, CONTAINS TO atlasmart_reader;SHOW ROLE atlasmart_reader PRIVILEGES AS COMMANDS;

Property allowlists are safer than {*} when new properties could contain secrets/PII. The tradeoff is schema-evolution work: a newly required property must be deliberately granted.

4. Order writer without broad WRITE

CREATE ROLE atlasmart_order_writer IF NOT EXISTS;GRANT ACCESS ON DATABASE neo4j TO atlasmart_order_writer;GRANT MATCH {orderId, status, tenantId}  ON GRAPH neo4j NODES Order TO atlasmart_order_writer;GRANT SET PROPERTY {status}  ON GRAPH neo4j NODES Order TO atlasmart_order_writer;// Deliberately do NOT grant DELETE, user management,// index/constraint management, or broad WRITE.SHOW ROLE atlasmart_order_writer PRIVILEGES AS COMMANDS;

CYPHER 25MATCH (o:Order {orderId:$orderId, tenantId:$tenantId})SET o.status=$statusRETURN o.orderId, o.status;

CYPHER 25MATCH (c:Customer {customerId:$customerId})DETACH DELETE c;

5. Procedure execution is an authorization surface

CREATE ROLE atlasmart_visualizer IF NOT EXISTS;GRANT EXECUTE PROCEDURE db.schema.visualization  ON DBMS TO atlasmart_visualizer;// Boosting is intentionally not granted.SHOW ROLE atlasmart_visualizer PRIVILEGES AS COMMANDS;

Execution permission and the caller’s graph privileges are separate. A normal procedure call runs under the user’s effective privileges. Boosted execution can exceed them, so it should be rare, explicit, reviewed and tested as a privileged code path.

6. Community deterministic fallback

7. Privilege regression tests

CASES = [    ("read-own-order", "expected_allow"),    ("read-cross-tenant-order", "expected_deny"),    ("set-order-status", "expected_allow"),    ("delete-customer", "expected_deny"),    ("create-index", "expected_deny"),    ("show-users", "expected_deny"),]# In Enterprise/Aura-capable RBAC tests, authenticate as the service user# and assert the DBMS actually denies the forbidden statements.# In Community, mark DB-level deny cases UNSUPPORTED rather than falsely PASS.

Production judgment

Summary and next step

Least privilege is an executable contract across database admission, graph elements, properties, writes, schema and extensions. Lesson 3 protects those authenticated/authorized operations in transit and shows why encryption without certificate verification is not enough.

Authoritative references

• Current Neo4j versions — Current server and 5.26 LTS release snapshot.
• Security checklist — Official baseline for deployment, transport, extensions, backup and filesystem security.
• Manage users — Native users, password handling, Community/Enterprise user-model distinctions.
• Role-based access control — Enterprise RBAC model and GRANT/DENY/REVOKE semantics.
• Read privileges — TRAVERSE, READ and MATCH graph privilege semantics.
• Write privileges — CREATE, DELETE, SET, MERGE and WRITE privilege semantics.
• SSL framework — Bolt/HTTPS TLS policies, certificate files, TLS levels and URI schemes.
• Procedure/function privileges — Execute and boosted-execution privilege boundaries.
• Python driver advanced connections — TLS/trust and rotating authentication token support in the maintained Python driver.
• Built-in roles — Enterprise/Aura built-in role capabilities.
• DBMS privileges — System-wide administrative privilege model.
• Access-control limitations — Subgraph/label visibility nuances relevant to fine-grained authorization.