MarkLogic authorization is organized around roles. Users receive one or more roles, roles can inherit other roles, and the resulting role graph supplies effective privileges and document permissions. Three controls must then be kept separate: execute privileges protect named code or actions, URI privileges govern creation of documents beneath protected URI prefixes, and document permissions govern capabilities on particular documents. In the security context, “delegation” refers to an Amp temporarily supplying additional roles for a protected action; it is not the same thing as role inheritance.
How does role-based access control work in MarkLogic?
A MarkLogic request starts with an authenticated user. That user may have several roles assigned directly. Each of those roles may inherit one or more parent roles, so the effective security context includes authority from the entire inheritance graph, not just the roles visible on the user record.
As an Amazon Associate I earn from qualifying purchases.
The effective context is used in several places:
- An execute privilege can allow a protected XQuery or JavaScript action.
- A URI privilege can allow creation of a new document whose URI falls under a protected prefix.
- Permissions stored on an existing document can grant a capability such as reading, inserting, updating, node-updating, or executing against that document.
These mechanisms work together, but none is a replacement for the others. A role that can execute a protected function does not automatically grant read access to every document the function might touch. Likewise, permission to create a document below a URI prefix does not itself grant permission to update or read an already existing document.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchRoles are the organizing layer
A role is a named security object to which privileges and permissions can be associated. A user can receive several roles, for example one role for an application and another for operational reporting. A role can also be assigned to another role. The inheriting role receives the parent role’s privileges and permissions, so authority accumulates through the role relationship.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
This is best understood as an “is-a” relationship: if reporting-app inherits document-reader, a user with reporting-app has the authority supplied by both roles. Adding a role to a user can therefore add more than the privileges shown on that user’s direct assignment list.
The effective-authority flow
- Authenticate the user. MarkLogic establishes the identity used for the request.
- Resolve direct roles. Every role assigned to the user is considered.
- Expand inherited roles. Parent roles contribute their privileges and role-based permissions.
- Evaluate the requested operation. MarkLogic checks any required execute privilege, URI privilege, and document permission relevant to the operation.
- Apply scoped additions, if any. An Amp can temporarily provide additional roles during a protected action.
In a small deployment this may be easy to reason about. In a mature system with many roles, default permissions, and inheritance edges, manually calculating the result is error-prone. The MarkLogic 11 Security Guide recommends inspecting the user in Admin Interface > Security > User > Describe to see effective privileges and default-permission information. Interface fields can differ by release, so use the labels in the installed version.
What is the difference between an execute privilege, a URI privilege, and a document permission?
The distinction is primarily about what is protected and where the rule is attached.
| Control | Protects | Where the rule is defined | Typical question it answers |
|---|---|---|---|
| Execute privilege | A named protected action, commonly XQuery or JavaScript code | Privilege configuration, with an action URI and authorized roles | “May this user invoke this protected function or action?” |
| URI privilege | Creation of a new document below a protected base or prefix URI | Privilege configuration, with the protected URI range and authorized roles | “May this user create a document at this URI?” |
| Document permission | A capability on a particular existing document | The document’s permission set, pairing roles with capabilities | “May this role read, insert, update, node-update, or execute against this document?” |
MarkLogic documentation uses slightly different capability lists in different contexts. The MarkLogic 11 Security Guide lists read, insert, update, node-update, and execute; MarkLogic 11 Admin help lists read, insert, update, and execute in its role-configuration description. Check the detailed security guide for the exact capabilities supported by the release you run.
Execute privileges protect code and actions
An execute privilege specifies a protected action and the roles allowed to perform it. In MarkLogic 12 configuration help, the protected action is represented by a URI, and roles are associated with that privilege. The URI identifies the action; it does not mean that the privilege grants general access to every document whose URI looks similar.
Protected XQuery or JavaScript code can explicitly check for a required privilege. The MarkLogic 11 Security Guide gives this illustrative syntax:
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
xdmp:security-assert("Priv1", "execute")The check asks whether the acting user has execute authority for the named privilege. Treat the example as documentation syntax and confirm function behavior and language support against the target server version before putting it into production code.
Use an execute privilege when the sensitive boundary is an operation: for example, a function that changes configuration, performs a privileged transformation, or exposes data assembled by protected code. Keep the privilege associated with a narrowly named action and grant it to an application role rather than to every user individually.
URI privileges govern document creation
A URI privilege controls whether a user may create a new document whose URI falls under a protected base or prefix URI. This is a creation check. It does not become the document’s read, update, or node-update policy after the document exists.
For example, a privilege could protect creation beneath a URI family used for regulated imports. A role authorized for that URI privilege may create a qualifying document, but subsequent operations still depend on permissions attached to that document and on any other checks required by the operation. Configure document permissions deliberately when the document is created; do not assume the URI privilege supplies them.
Document permissions are role-capability pairs
Permissions are attached to individual documents. Each permission pairs a role with a capability. The role may be direct or inherited, so a document permission granted to a parent role can be effective for a user who receives a child role.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →The capability determines the operation. Common entries documented for MarkLogic 11 include:
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
- read: permission to read the document.
- insert: permission associated with inserting document content.
- update: permission to update the document.
- node-update: permission for node-level updates where supported by the deployment.
- execute: permission associated with executing content represented by the document.
Do not confuse a document’s execute permission with an execute privilege. The former is a capability in a document’s permission set; the latter is a named privilege protecting an action or piece of code.
How do MarkLogic roles inherit privileges?
Inheritance is configured between roles, not between a user and a temporary session. If role A inherits role B, A receives B’s privileges and permissions in addition to its own. A user assigned both A and another role receives the union of the authority contributed by all direct and inherited roles, subject to the operation’s specific checks.
This graph explains why removing an apparently unused direct privilege may not reduce authority: the same privilege may arrive through a parent role. It also explains why a narrowly named application role can be safer than assigning broad built-in roles directly to users.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →A practical inheritance design
- Create small roles around stable responsibilities, such as reading a collection of business documents or invoking one protected service action.
- Use inheritance to compose those responsibilities into application or team roles.
- Assign users the composed role instead of duplicating every privilege on each user account.
- Review parent-role changes as carefully as direct user assignments; one parent change can affect many users.
- Inspect effective authority in the Admin Interface when a denial or unexpected access cannot be explained from direct assignments.
Inheritance is not an automatic “deny” layer. It adds authority from parent roles. If a design needs a smaller authority set, create a role with only the required associations rather than inheriting a broad administrative role and attempting to subtract permissions later.
What does delegation mean in MarkLogic security?
“Delegation” is not one universal MarkLogic RBAC object. In the authorization concept described by MarkLogic, an Amp provides additional privileges by temporarily giving a user additional roles for the duration of a protected action. The extra authority is scoped to that action rather than permanently assigned to the user’s account.
That is different from inheritance:
| Mechanism | Duration | Relationship | Use |
|---|---|---|---|
| Role inheritance | Persistent until the role configuration changes | One role inherits another role | Compose reusable authority for users and applications |
| Amp-based temporary roles | Only while the protected action runs | The protected action receives additional roles for its scope | Perform a narrowly controlled operation without permanently broadening the caller’s roles |
Keep Amp authority narrow and audit the protected code that can invoke it. Temporary authority does not make an unsafe action safe by itself; the action still needs careful input validation and a clearly defined privilege boundary.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
MarkLogic documentation also uses the word “delegation” in an unrelated search feature: a custom stemming plugin may delegate work to the default stemmer. That terminology concerns text processing, not authorization, roles, privileges, or temporary security authority.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsHow administrators can inspect and verify authorization
Inspect a user’s effective security context
- Open the MarkLogic Admin Interface.
- Go to Security, then User.
- Open the relevant user and choose Describe.
- Review the effective privileges and default-permission information shown for that user.
- Trace each unexpected privilege back through direct role assignments and inherited parent roles before changing configuration.
The exact presentation and available fields depend on the deployed release. The Security Guide’s recommendation is especially important when many roles make a hand-built calculation unreliable.
Check which roles a privilege names
In MarkLogic 12, sec:privilege-get-roles(action, kind) returns the names of roles assigned to the specified privilege. The kind argument is execute or uri. Run the function against the security database. For example, an administrator can use the function to verify which roles are attached to a particular execute privilege or URI privilege.
This function answers the privilege-to-role question only. It does not calculate every user’s effective authority through a complete inheritance graph, nor does it replace inspection of document permissions.
Why admin and security roles require caution
The built-in admin role has full authority in the MarkLogic 11 security guidance. It is intended for administration, not routine data loading or application execution. Granting it to an application account turns an application compromise or coding mistake into a platform-wide administrative event.
Free tools Windows power users keep installed
One-click scans. No signup required.
The security role is also sensitive because it enables security-management tasks and can be used in operations that assign or utilize administrative authority. Treat it as a security-administration role, not a convenient shortcut for resolving ordinary permission errors.
A safer pattern is to create purpose-specific roles, grant only the required execute or URI privileges, and attach the minimum document capabilities needed by the application. Test with a non-administrative account that matches the production role graph.
Common authorization failures and how to diagnose them
“The user has the role, but the function still fails”
Confirm that the function’s protected action is represented by the exact execute-privilege URI expected by the code. Then inspect the user to verify that the role is effective, including inherited roles. Finally, check whether the protected code performs an explicit security assertion for a different privilege name.
“The user can create a URI but cannot read the document”
This is expected when a URI privilege is present without a matching document read permission. Review the permissions written on the newly created document and ensure they include the role that should read it.
“Updating an existing document is denied even though creation worked”
Creation under a protected URI and updating an existing document are separate decisions. Check the document’s update or, where applicable, node-update permission for an effective role. Do not try to fix an update denial by adding an unrelated URI privilege.
“Removing a direct assignment changed nothing”
The authority may still arrive through an inherited parent role or another direct role. Use the user’s Describe view and trace the role graph before removing additional associations.
Version boundaries to keep in mind
The conceptual model is documented across MarkLogic 9, 11, and 12 materials: roles, inheritance, execute privileges, URI privileges, document permissions, and scoped Amp authority remain the central ideas. Interface labels, role-configuration fields, supported permission capabilities, and API availability can change between releases. The MarkLogic 9 Administrator’s and Concepts Guides are useful for the inheritance and Amp concepts; MarkLogic 11 security documentation provides the detailed role and permission discussion; MarkLogic 12 documentation covers execute-privilege configuration and sec:privilege-get-roles.
For a production change, verify the syntax and fields against the exact server version deployed, run administrative inspection against the security database where required, and test the complete effective role graph rather than only the direct user record.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
