Create SQL-driven ClickHouse users, assign privileges directly or via roles using CREATE USER / CREATE ROLE / GRANT, after enabling access_management on self-managed deployments.

Documented steps

1. On self-managed ClickHouse, SQL-driven access control is disabled by default for all users; enable it for at least one bootstrap user (commonly 'default') in users.xml by setting: <access_management>1</access_management> <named_collection_control>1</named_collection_control> <show_named_collections>1</show_named_collections> <show_named_collections_secrets>1</show_named_collections_secrets>, then restart the node(s). (ClickHouse Cloud manages this differently — see its own access management docs.)
2. Connect as that bootstrap user: clickhouse-client --user default --password "$CLICKHOUSE_PASSWORD"
3. Create a SQL administrator account and grant it full rights: CREATE USER clickhouse_admin IDENTIFIED BY '<strong-password>'; GRANT ALL ON *.* TO clickhouse_admin WITH GRANT OPTION;
4. Create ordinary users the same way: CREATE USER my_user IDENTIFIED BY '<strong-password>'; — to grant or revoke privileges as an admin, that admin account must itself hold WITH GRANT OPTION on those privileges.
5. Create a role and grant privileges to the role rather than individual users: CREATE ROLE accountant; GRANT SELECT ON db.* TO accountant;
6. Assign the role to a user with GRANT <role> TO <user>, e.g. GRANT accountant TO mira; — general grant syntax is GRANT privilege[(cols)] ON {db.table|db.*|*.*} TO {user|role|CURRENT_USER} [WITH GRANT OPTION] [WITH REPLACE OPTION], and role assignment is GRANT role TO {user|role} [WITH ADMIN OPTION].
7. Review effective privileges at any time with SHOW GRANTS (for the current or a named user), and revoke with the REVOKE statement or DROP USER/DROP ROLE to remove entities entirely.
8. Reference: https://clickhouse.com/docs/operations/access-rights