Package com.google.cloud.privilegedaccessmanager.v1 (0.3.0)

GitHub Repository RPC Documentation

Client Classes

Client classes are the main entry point to using a package. They contain several variations of Java methods for each of the API's methods.

Client Description
com.google.cloud.privilegedaccessmanager.v1.PrivilegedAccessManagerClient Service Description: This API allows customers to manage temporary, request based privileged access to their resources.

It defines the following resource model:

Settings Classes

Settings classes can be used to configure credentials, endpoints, and retry settings for a Client.

Settings Description
com.google.cloud.privilegedaccessmanager.v1.PrivilegedAccessManagerSettings Settings class to configure an instance of PrivilegedAccessManagerClient.

The default instance has everything set to sensible defaults:

Classes

Class Description
com.google.cloud.privilegedaccessmanager.v1.AccessControlEntry AccessControlEntry is used to control who can do some operation.
com.google.cloud.privilegedaccessmanager.v1.AccessControlEntry.Builder AccessControlEntry is used to control who can do some operation.
com.google.cloud.privilegedaccessmanager.v1.ApprovalWorkflow Different types of approval workflows that can be used to gate privileged access granting.
com.google.cloud.privilegedaccessmanager.v1.ApprovalWorkflow.Builder Different types of approval workflows that can be used to gate privileged access granting.
com.google.cloud.privilegedaccessmanager.v1.ApproveGrantRequest Request message for ApproveGrant method.
com.google.cloud.privilegedaccessmanager.v1.ApproveGrantRequest.Builder Request message for ApproveGrant method.
com.google.cloud.privilegedaccessmanager.v1.CheckOnboardingStatusRequest Request message for CheckOnboardingStatus method.
com.google.cloud.privilegedaccessmanager.v1.CheckOnboardingStatusRequest.Builder Request message for CheckOnboardingStatus method.
com.google.cloud.privilegedaccessmanager.v1.CheckOnboardingStatusResponse Response message for CheckOnboardingStatus method.
com.google.cloud.privilegedaccessmanager.v1.CheckOnboardingStatusResponse.Builder Response message for CheckOnboardingStatus method.
com.google.cloud.privilegedaccessmanager.v1.CheckOnboardingStatusResponse.Finding Finding represents an issue which prevents PAM from functioning properly for this resource.
com.google.cloud.privilegedaccessmanager.v1.CheckOnboardingStatusResponse.Finding.Builder Finding represents an issue which prevents PAM from functioning properly for this resource.
com.google.cloud.privilegedaccessmanager.v1.CheckOnboardingStatusResponse.Finding.IAMAccessDenied PAM's service account is being denied access by Cloud IAM. This can be fixed by granting a role that contains the missing permissions to the service account or exempting it from deny policies if
com.google.cloud.privilegedaccessmanager.v1.CheckOnboardingStatusResponse.Finding.IAMAccessDenied.Builder PAM's service account is being denied access by Cloud IAM. This can be fixed by granting a role that contains the missing permissions to the service account or exempting it from deny policies if
com.google.cloud.privilegedaccessmanager.v1.CreateEntitlementRequest Message for creating an entitlement.
com.google.cloud.privilegedaccessmanager.v1.CreateEntitlementRequest.Builder Message for creating an entitlement.
com.google.cloud.privilegedaccessmanager.v1.CreateGrantRequest Message for creating a grant
com.google.cloud.privilegedaccessmanager.v1.CreateGrantRequest.Builder Message for creating a grant
com.google.cloud.privilegedaccessmanager.v1.DeleteEntitlementRequest Message for deleting an entitlement.
com.google.cloud.privilegedaccessmanager.v1.DeleteEntitlementRequest.Builder Message for deleting an entitlement.
com.google.cloud.privilegedaccessmanager.v1.DenyGrantRequest Request message for DenyGrant method.
com.google.cloud.privilegedaccessmanager.v1.DenyGrantRequest.Builder Request message for DenyGrant method.
com.google.cloud.privilegedaccessmanager.v1.Entitlement An entitlement defines the eligibility of a set of users to obtain predefined access for some time possibly after going through an approval workflow.
com.google.cloud.privilegedaccessmanager.v1.Entitlement.AdditionalNotificationTargets AdditionalNotificationTargets includes email addresses to be notified.
com.google.cloud.privilegedaccessmanager.v1.Entitlement.AdditionalNotificationTargets.Builder AdditionalNotificationTargets includes email addresses to be notified.
com.google.cloud.privilegedaccessmanager.v1.Entitlement.Builder An entitlement defines the eligibility of a set of users to obtain predefined access for some time possibly after going through an approval workflow.
com.google.cloud.privilegedaccessmanager.v1.Entitlement.RequesterJustificationConfig Defines how a requester must provide a justification when requesting access.
com.google.cloud.privilegedaccessmanager.v1.Entitlement.RequesterJustificationConfig.Builder Defines how a requester must provide a justification when requesting access.
com.google.cloud.privilegedaccessmanager.v1.Entitlement.RequesterJustificationConfig.NotMandatory The justification is not mandatory but can be provided in any of the supported formats.
com.google.cloud.privilegedaccessmanager.v1.Entitlement.RequesterJustificationConfig.NotMandatory.Builder The justification is not mandatory but can be provided in any of the supported formats.
com.google.cloud.privilegedaccessmanager.v1.Entitlement.RequesterJustificationConfig.Unstructured The requester has to provide a justification in the form of a string.
com.google.cloud.privilegedaccessmanager.v1.Entitlement.RequesterJustificationConfig.Unstructured.Builder The requester has to provide a justification in the form of a string.
com.google.cloud.privilegedaccessmanager.v1.EntitlementName
com.google.cloud.privilegedaccessmanager.v1.EntitlementName.Builder Builder for projects/{project}/locations/{location}/entitlements/{entitlement}.
com.google.cloud.privilegedaccessmanager.v1.EntitlementName.FolderLocationEntitlementBuilder Builder for folders/{folder}/locations/{location}/entitlements/{entitlement}.
com.google.cloud.privilegedaccessmanager.v1.EntitlementName.OrganizationLocationEntitlementBuilder Builder for organizations/{organization}/locations/{location}/entitlements/{entitlement}.
com.google.cloud.privilegedaccessmanager.v1.FolderLocationName
com.google.cloud.privilegedaccessmanager.v1.FolderLocationName.Builder Builder for folders/{folder}/locations/{location}.
com.google.cloud.privilegedaccessmanager.v1.GetEntitlementRequest Message for getting an entitlement.
com.google.cloud.privilegedaccessmanager.v1.GetEntitlementRequest.Builder Message for getting an entitlement.
com.google.cloud.privilegedaccessmanager.v1.GetGrantRequest Message for getting a grant.
com.google.cloud.privilegedaccessmanager.v1.GetGrantRequest.Builder Message for getting a grant.
com.google.cloud.privilegedaccessmanager.v1.Grant This is to ensure that the Grants and ProducerGrants proto are byte compatible. A grant represents a request from a user for obtaining the access specified
com.google.cloud.privilegedaccessmanager.v1.Grant.AuditTrail Audit trail for the access provided by this grant.
com.google.cloud.privilegedaccessmanager.v1.Grant.AuditTrail.Builder Audit trail for the access provided by this grant.
com.google.cloud.privilegedaccessmanager.v1.Grant.Builder This is to ensure that the Grants and ProducerGrants proto are byte compatible. A grant represents a request from a user for obtaining the access specified
com.google.cloud.privilegedaccessmanager.v1.Grant.Timeline Timeline of a grant describing what happened to it and when.
com.google.cloud.privilegedaccessmanager.v1.Grant.Timeline.Builder Timeline of a grant describing what happened to it and when.
com.google.cloud.privilegedaccessmanager.v1.Grant.Timeline.Event A single operation on the grant.
com.google.cloud.privilegedaccessmanager.v1.Grant.Timeline.Event.Activated An event representing that the grant was successfully activated.
com.google.cloud.privilegedaccessmanager.v1.Grant.Timeline.Event.Activated.Builder An event representing that the grant was successfully activated.
com.google.cloud.privilegedaccessmanager.v1.Grant.Timeline.Event.ActivationFailed An event representing that the grant activation failed.
com.google.cloud.privilegedaccessmanager.v1.Grant.Timeline.Event.ActivationFailed.Builder An event representing that the grant activation failed.
com.google.cloud.privilegedaccessmanager.v1.Grant.Timeline.Event.Approved An event representing that the grant was approved.
com.google.cloud.privilegedaccessmanager.v1.Grant.Timeline.Event.Approved.Builder An event representing that the grant was approved.
com.google.cloud.privilegedaccessmanager.v1.Grant.Timeline.Event.Builder A single operation on the grant.
com.google.cloud.privilegedaccessmanager.v1.Grant.Timeline.Event.Denied An event representing that the grant was denied.
com.google.cloud.privilegedaccessmanager.v1.Grant.Timeline.Event.Denied.Builder An event representing that the grant was denied.
com.google.cloud.privilegedaccessmanager.v1.Grant.Timeline.Event.Ended An event representing that the grant has ended.
com.google.cloud.privilegedaccessmanager.v1.Grant.Timeline.Event.Ended.Builder An event representing that the grant has ended.
com.google.cloud.privilegedaccessmanager.v1.Grant.Timeline.Event.Expired An event representing that the grant was expired.
com.google.cloud.privilegedaccessmanager.v1.Grant.Timeline.Event.Expired.Builder An event representing that the grant was expired.
com.google.cloud.privilegedaccessmanager.v1.Grant.Timeline.Event.ExternallyModified An event representing that the policy bindings made by this grant were modified externally.
com.google.cloud.privilegedaccessmanager.v1.Grant.Timeline.Event.ExternallyModified.Builder An event representing that the policy bindings made by this grant were modified externally.
com.google.cloud.privilegedaccessmanager.v1.Grant.Timeline.Event.Requested An event representing that a grant was requested.
com.google.cloud.privilegedaccessmanager.v1.Grant.Timeline.Event.Requested.Builder An event representing that a grant was requested.
com.google.cloud.privilegedaccessmanager.v1.Grant.Timeline.Event.Revoked An event representing that the grant was revoked.
com.google.cloud.privilegedaccessmanager.v1.Grant.Timeline.Event.Revoked.Builder An event representing that the grant was revoked.
com.google.cloud.privilegedaccessmanager.v1.Grant.Timeline.Event.Scheduled An event representing that the grant has been scheduled to be activated later.
com.google.cloud.privilegedaccessmanager.v1.Grant.Timeline.Event.Scheduled.Builder An event representing that the grant has been scheduled to be activated later.
com.google.cloud.privilegedaccessmanager.v1.GrantName
com.google.cloud.privilegedaccessmanager.v1.GrantName.Builder Builder for projects/{project}/locations/{location}/entitlements/{entitlement}/grants/{grant}.
com.google.cloud.privilegedaccessmanager.v1.GrantName.FolderLocationEntitlementGrantBuilder Builder for folders/{folder}/locations/{location}/entitlements/{entitlement}/grants/{grant}.
com.google.cloud.privilegedaccessmanager.v1.GrantName.OrganizationLocationEntitlementGrantBuilder Builder for organizations/{organization}/locations/{location}/entitlements/{entitlement}/grants/{grant}.
com.google.cloud.privilegedaccessmanager.v1.Justification Justification represents a justification for requesting access.
com.google.cloud.privilegedaccessmanager.v1.Justification.Builder Justification represents a justification for requesting access.
com.google.cloud.privilegedaccessmanager.v1.ListEntitlementsRequest Message for requesting list of entitlements.
com.google.cloud.privilegedaccessmanager.v1.ListEntitlementsRequest.Builder Message for requesting list of entitlements.
com.google.cloud.privilegedaccessmanager.v1.ListEntitlementsResponse Message for response to listing entitlements.
com.google.cloud.privilegedaccessmanager.v1.ListEntitlementsResponse.Builder Message for response to listing entitlements.
com.google.cloud.privilegedaccessmanager.v1.ListGrantsRequest Message for requesting list of grants.
com.google.cloud.privilegedaccessmanager.v1.ListGrantsRequest.Builder Message for requesting list of grants.
com.google.cloud.privilegedaccessmanager.v1.ListGrantsResponse Message for response to listing grants.
com.google.cloud.privilegedaccessmanager.v1.ListGrantsResponse.Builder Message for response to listing grants.
com.google.cloud.privilegedaccessmanager.v1.LocationName
com.google.cloud.privilegedaccessmanager.v1.LocationName.Builder Builder for projects/{project}/locations/{location}.
com.google.cloud.privilegedaccessmanager.v1.ManualApprovals A manual approval workflow where users who are designated as approvers need to call the ApproveGrant/DenyGrant APIs for a grant. The workflow can consist of multiple serial steps where each step defines who can act as
com.google.cloud.privilegedaccessmanager.v1.ManualApprovals.Builder A manual approval workflow where users who are designated as approvers need to call the ApproveGrant/DenyGrant APIs for a grant. The workflow can consist of multiple serial steps where each step defines who can act as
com.google.cloud.privilegedaccessmanager.v1.ManualApprovals.Step Step represents a logical step in a manual approval workflow.
com.google.cloud.privilegedaccessmanager.v1.ManualApprovals.Step.Builder Step represents a logical step in a manual approval workflow.
com.google.cloud.privilegedaccessmanager.v1.OperationMetadata Represents the metadata of the long-running operation.
com.google.cloud.privilegedaccessmanager.v1.OperationMetadata.Builder Represents the metadata of the long-running operation.
com.google.cloud.privilegedaccessmanager.v1.OrganizationLocationName
com.google.cloud.privilegedaccessmanager.v1.OrganizationLocationName.Builder Builder for organizations/{organization}/locations/{location}.
com.google.cloud.privilegedaccessmanager.v1.PrivilegedAccess Privileged access that this service can be used to gate.
com.google.cloud.privilegedaccessmanager.v1.PrivilegedAccess.Builder Privileged access that this service can be used to gate.
com.google.cloud.privilegedaccessmanager.v1.PrivilegedAccess.GcpIamAccess GcpIamAccess represents IAM based access control on a Google Cloud resource. Refer to https://cloud.google.com/iam/docs to understand more about IAM.
com.google.cloud.privilegedaccessmanager.v1.PrivilegedAccess.GcpIamAccess.Builder GcpIamAccess represents IAM based access control on a Google Cloud resource. Refer to https://cloud.google.com/iam/docs to understand more about IAM.
com.google.cloud.privilegedaccessmanager.v1.PrivilegedAccess.GcpIamAccess.RoleBinding IAM Role bindings that are created after a successful grant.
com.google.cloud.privilegedaccessmanager.v1.PrivilegedAccess.GcpIamAccess.RoleBinding.Builder IAM Role bindings that are created after a successful grant.
com.google.cloud.privilegedaccessmanager.v1.PrivilegedAccessManagerClient.ListEntitlementsFixedSizeCollection
com.google.cloud.privilegedaccessmanager.v1.PrivilegedAccessManagerClient.ListEntitlementsPage
com.google.cloud.privilegedaccessmanager.v1.PrivilegedAccessManagerClient.ListEntitlementsPagedResponse
com.google.cloud.privilegedaccessmanager.v1.PrivilegedAccessManagerClient.ListGrantsFixedSizeCollection
com.google.cloud.privilegedaccessmanager.v1.PrivilegedAccessManagerClient.ListGrantsPage
com.google.cloud.privilegedaccessmanager.v1.PrivilegedAccessManagerClient.ListGrantsPagedResponse
com.google.cloud.privilegedaccessmanager.v1.PrivilegedAccessManagerClient.ListLocationsFixedSizeCollection
com.google.cloud.privilegedaccessmanager.v1.PrivilegedAccessManagerClient.ListLocationsPage
com.google.cloud.privilegedaccessmanager.v1.PrivilegedAccessManagerClient.ListLocationsPagedResponse
com.google.cloud.privilegedaccessmanager.v1.PrivilegedAccessManagerClient.SearchEntitlementsFixedSizeCollection
com.google.cloud.privilegedaccessmanager.v1.PrivilegedAccessManagerClient.SearchEntitlementsPage
com.google.cloud.privilegedaccessmanager.v1.PrivilegedAccessManagerClient.SearchEntitlementsPagedResponse
com.google.cloud.privilegedaccessmanager.v1.PrivilegedAccessManagerClient.SearchGrantsFixedSizeCollection
com.google.cloud.privilegedaccessmanager.v1.PrivilegedAccessManagerClient.SearchGrantsPage
com.google.cloud.privilegedaccessmanager.v1.PrivilegedAccessManagerClient.SearchGrantsPagedResponse
com.google.cloud.privilegedaccessmanager.v1.PrivilegedAccessManagerGrpc This API allows customers to manage temporary, request based privileged access to their resources. It defines the following resource model:
com.google.cloud.privilegedaccessmanager.v1.PrivilegedAccessManagerGrpc.PrivilegedAccessManagerImplBase Base class for the server implementation of the service PrivilegedAccessManager. This API allows customers to manage temporary, request based privileged
com.google.cloud.privilegedaccessmanager.v1.PrivilegedAccessManagerProto
com.google.cloud.privilegedaccessmanager.v1.PrivilegedAccessManagerSettings.Builder Builder for PrivilegedAccessManagerSettings.
com.google.cloud.privilegedaccessmanager.v1.RevokeGrantRequest Request message for RevokeGrant method.
com.google.cloud.privilegedaccessmanager.v1.RevokeGrantRequest.Builder Request message for RevokeGrant method.
com.google.cloud.privilegedaccessmanager.v1.SearchEntitlementsRequest Request message for SearchEntitlements method.
com.google.cloud.privilegedaccessmanager.v1.SearchEntitlementsRequest.Builder Request message for SearchEntitlements method.
com.google.cloud.privilegedaccessmanager.v1.SearchEntitlementsResponse Response message for SearchEntitlements method.
com.google.cloud.privilegedaccessmanager.v1.SearchEntitlementsResponse.Builder Response message for SearchEntitlements method.
com.google.cloud.privilegedaccessmanager.v1.SearchGrantsRequest Request message for SearchGrants method.
com.google.cloud.privilegedaccessmanager.v1.SearchGrantsRequest.Builder Request message for SearchGrants method.
com.google.cloud.privilegedaccessmanager.v1.SearchGrantsResponse Response message for SearchGrants method.
com.google.cloud.privilegedaccessmanager.v1.SearchGrantsResponse.Builder Response message for SearchGrants method.
com.google.cloud.privilegedaccessmanager.v1.UpdateEntitlementRequest Message for updating an entitlement.
com.google.cloud.privilegedaccessmanager.v1.UpdateEntitlementRequest.Builder Message for updating an entitlement.

Interfaces

Interface Description
com.google.cloud.privilegedaccessmanager.v1.AccessControlEntryOrBuilder
com.google.cloud.privilegedaccessmanager.v1.ApprovalWorkflowOrBuilder
com.google.cloud.privilegedaccessmanager.v1.ApproveGrantRequestOrBuilder
com.google.cloud.privilegedaccessmanager.v1.CheckOnboardingStatusRequestOrBuilder
com.google.cloud.privilegedaccessmanager.v1.CheckOnboardingStatusResponse.Finding.IAMAccessDeniedOrBuilder
com.google.cloud.privilegedaccessmanager.v1.CheckOnboardingStatusResponse.FindingOrBuilder
com.google.cloud.privilegedaccessmanager.v1.CheckOnboardingStatusResponseOrBuilder
com.google.cloud.privilegedaccessmanager.v1.CreateEntitlementRequestOrBuilder
com.google.cloud.privilegedaccessmanager.v1.CreateGrantRequestOrBuilder
com.google.cloud.privilegedaccessmanager.v1.DeleteEntitlementRequestOrBuilder
com.google.cloud.privilegedaccessmanager.v1.DenyGrantRequestOrBuilder
com.google.cloud.privilegedaccessmanager.v1.Entitlement.AdditionalNotificationTargetsOrBuilder
com.google.cloud.privilegedaccessmanager.v1.Entitlement.RequesterJustificationConfig.NotMandatoryOrBuilder
com.google.cloud.privilegedaccessmanager.v1.Entitlement.RequesterJustificationConfig.UnstructuredOrBuilder
com.google.cloud.privilegedaccessmanager.v1.Entitlement.RequesterJustificationConfigOrBuilder
com.google.cloud.privilegedaccessmanager.v1.EntitlementOrBuilder
com.google.cloud.privilegedaccessmanager.v1.GetEntitlementRequestOrBuilder
com.google.cloud.privilegedaccessmanager.v1.GetGrantRequestOrBuilder
com.google.cloud.privilegedaccessmanager.v1.Grant.AuditTrailOrBuilder
com.google.cloud.privilegedaccessmanager.v1.Grant.Timeline.Event.ActivatedOrBuilder
com.google.cloud.privilegedaccessmanager.v1.Grant.Timeline.Event.ActivationFailedOrBuilder
com.google.cloud.privilegedaccessmanager.v1.Grant.Timeline.Event.ApprovedOrBuilder
com.google.cloud.privilegedaccessmanager.v1.Grant.Timeline.Event.DeniedOrBuilder
com.google.cloud.privilegedaccessmanager.v1.Grant.Timeline.Event.EndedOrBuilder
com.google.cloud.privilegedaccessmanager.v1.Grant.Timeline.Event.ExpiredOrBuilder
com.google.cloud.privilegedaccessmanager.v1.Grant.Timeline.Event.ExternallyModifiedOrBuilder
com.google.cloud.privilegedaccessmanager.v1.Grant.Timeline.Event.RequestedOrBuilder
com.google.cloud.privilegedaccessmanager.v1.Grant.Timeline.Event.RevokedOrBuilder
com.google.cloud.privilegedaccessmanager.v1.Grant.Timeline.Event.ScheduledOrBuilder
com.google.cloud.privilegedaccessmanager.v1.Grant.Timeline.EventOrBuilder
com.google.cloud.privilegedaccessmanager.v1.Grant.TimelineOrBuilder
com.google.cloud.privilegedaccessmanager.v1.GrantOrBuilder
com.google.cloud.privilegedaccessmanager.v1.JustificationOrBuilder
com.google.cloud.privilegedaccessmanager.v1.ListEntitlementsRequestOrBuilder
com.google.cloud.privilegedaccessmanager.v1.ListEntitlementsResponseOrBuilder
com.google.cloud.privilegedaccessmanager.v1.ListGrantsRequestOrBuilder
com.google.cloud.privilegedaccessmanager.v1.ListGrantsResponseOrBuilder
com.google.cloud.privilegedaccessmanager.v1.ManualApprovals.StepOrBuilder
com.google.cloud.privilegedaccessmanager.v1.ManualApprovalsOrBuilder
com.google.cloud.privilegedaccessmanager.v1.OperationMetadataOrBuilder
com.google.cloud.privilegedaccessmanager.v1.PrivilegedAccess.GcpIamAccess.RoleBindingOrBuilder
com.google.cloud.privilegedaccessmanager.v1.PrivilegedAccess.GcpIamAccessOrBuilder
com.google.cloud.privilegedaccessmanager.v1.PrivilegedAccessManagerGrpc.AsyncService This API allows customers to manage temporary, request based privileged access to their resources. It defines the following resource model:
com.google.cloud.privilegedaccessmanager.v1.PrivilegedAccessOrBuilder
com.google.cloud.privilegedaccessmanager.v1.RevokeGrantRequestOrBuilder
com.google.cloud.privilegedaccessmanager.v1.SearchEntitlementsRequestOrBuilder
com.google.cloud.privilegedaccessmanager.v1.SearchEntitlementsResponseOrBuilder
com.google.cloud.privilegedaccessmanager.v1.SearchGrantsRequestOrBuilder
com.google.cloud.privilegedaccessmanager.v1.SearchGrantsResponseOrBuilder
com.google.cloud.privilegedaccessmanager.v1.UpdateEntitlementRequestOrBuilder

Enums

Enum Description
com.google.cloud.privilegedaccessmanager.v1.ApprovalWorkflow.ApprovalWorkflowCase
com.google.cloud.privilegedaccessmanager.v1.CheckOnboardingStatusResponse.Finding.FindingTypeCase
com.google.cloud.privilegedaccessmanager.v1.Entitlement.RequesterJustificationConfig.JustificationTypeCase
com.google.cloud.privilegedaccessmanager.v1.Entitlement.State Different states an entitlement can be in.
com.google.cloud.privilegedaccessmanager.v1.Grant.State Different states a grant can be in.
com.google.cloud.privilegedaccessmanager.v1.Grant.Timeline.Event.EventCase
com.google.cloud.privilegedaccessmanager.v1.Justification.JustificationCase
com.google.cloud.privilegedaccessmanager.v1.PrivilegedAccess.AccessTypeCase
com.google.cloud.privilegedaccessmanager.v1.SearchEntitlementsRequest.CallerAccessType Different types of access a user can have on the entitlement resource.
com.google.cloud.privilegedaccessmanager.v1.SearchGrantsRequest.CallerRelationshipType Different types of relationships a user can have with a grant.