细粒度访问控制与审计

Basic roles grant broad access. Fine-grained access control lets you allow or deny access to specific labels, relationship types, and even individual properties.

In Neo4j, you compose roles from privileges like TRAVERSE, READ, MATCH, and WRITE. Each can be scoped to graph elements.

TRAVERSE lets a role find nodes and relationships. Without it, elements are invisible.

READ grants access to property values. You can grant it on specific properties only.

Use DENY to block a property even if a broader grant exists. Deny always wins over grant.

You can scope privileges to relationship types, hiding sensitive connections from certain roles.

List exactly what a role can do to verify your security model.

When a property is denied, queries simply return null for it rather than erroring. This keeps applications stable while protecting data.

Neo4j's security.log records authentication and administrative events. Enable and review it to audit access.

Good auditing means:

• Log auth successes and failures
• Review role privilege changes
• Use least-privilege roles
• Rotate credentials regularly

Start with no access, grant only what each role needs, deny sensitive fields explicitly, and audit continuously. Defense in depth keeps your graph safe.

Test your access control knowledge.

You learned fine-grained security:

• Compose roles from TRAVERSE, READ, MATCH, WRITE
• Scope privileges to labels, relationships, and properties
• DENY overrides GRANT
• Inspect privileges with SHOW ROLE
• Enable the security log and audit regularly