{
  "slug": "gcloud-sql-users-assign-roles-grants-or-revokes-database-roles-b7caae8c5150",
  "title": "gcloud sql users assign-roles grants or revokes database roles",
  "tools": [
    "gcloud"
  ],
  "tags": [
    "agent"
  ],
  "introduced_at": "2026-02-03T00:00:00.000Z",
  "announced_at": "2026-02-03T00:00:00.000Z",
  "effective_at": null,
  "date_basis": "source-publication",
  "status": "unknown",
  "how": {
    "incantation": "For a Cloud SQL MySQL or PostgreSQL user, use `gcloud sql users assign-roles` to grant roles; add `--revoke-existing-roles` to replace existing roles, or pass an empty `--database-roles` value with it to revoke all roles.",
    "examples": [
      "gcloud sql users assign-roles <USERNAME> --instance=<INSTANCE> --database-roles=<ROLE_1>,<ROLE_2> --type=BUILT_IN",
      "gcloud sql users assign-roles <USERNAME> --instance=<INSTANCE> --revoke-existing-roles --database-roles=<ROLE_1>,<ROLE_2> --type=BUILT_IN",
      "gcloud sql users assign-roles <USERNAME> --type=BUILT_IN --instance=<INSTANCE> --database-roles= --revoke-existing-roles"
    ],
    "gotchas": [
      "USERNAME (required): Cloud SQL username.",
      "--instance (-i) (required): Cloud SQL instance ID.",
      "--type (required): Cloud SQL user type; determines login authentication method. `BUILT_IN` represents a built-in user.",
      "--database-roles: Comma-separated roles to assign; available for MySQL and PostgreSQL. May be empty when revoking all roles.",
      "--revoke-existing-roles: Revoke the user's existing database roles; available for MySQL and PostgreSQL. Used with `--database-roles` to replace roles, or with an empty value to revoke all.",
      "--host: User hostname as an IP address, address range, or `%`; applies to MySQL and is ignored for other engines.",
      "Prerequisite: Custom roles must already exist in the database; create them with `CREATE ROLE` before assigning them.",
      "Applies to Postgres and MySQL users."
    ]
  },
  "why_it_matters": "Grant or revoke roles for a Postgres or MySQL user in Cloud SQL.",
  "sources": [
    "https://docs.cloud.google.com/sdk/docs/release-notes#55500_2026-02-03",
    "https://docs.cloud.google.com/sdk/gcloud/reference/sql/users/assign-roles",
    "https://docs.cloud.google.com/sql/docs/postgres/create-manage-users"
  ],
  "rank": 0.98036,
  "judge": {
    "publish": true,
    "judge_model": "codex-cli/gpt-6-luna+typesafe/jev-1.13.0",
    "prompt_version": "extract-v7+enrich-v1+judge-v2x3+jev-publish-v1"
  },
  "review_state": "approved",
  "provenance": {
    "run_id": "cloud-20261008",
    "verdict_id": "cloud-20261008:cloud-20261008-76320a1a7b811af2-1:gate",
    "evidence_hash": "4a858bb3b2e9d74dc25935422744209290d5f9e53a12140ad3bfbc9bc677924f"
  },
  "review": {
    "draft_hash": "b15feb026376debb3c9b72da9f492e26b46eebf0c771a5d07ea0868c00573db5",
    "reviewer": "publication-gate",
    "reviewed_at": "2026-10-07T00:00:00.000Z",
    "decision": "cloud-20261008:gate",
    "reason": "3 of 3 judge runs approved with p_yes >= 0.9 (mean 0.98 >= 0.9; 2 needed) and Jev gave 0.64 (>= 0.6 needed)."
  }
}