diff --git a/modules/ROOT/images/privileges_grant_and_deny_syntax_database_privileges.svg b/modules/ROOT/images/privileges_grant_and_deny_syntax_database_privileges.svg
index 4e0babc35..59ffa7f49 100644
--- a/modules/ROOT/images/privileges_grant_and_deny_syntax_database_privileges.svg
+++ b/modules/ROOT/images/privileges_grant_and_deny_syntax_database_privileges.svg
@@ -1,99 +1 @@
-
+
\ No newline at end of file
diff --git a/modules/ROOT/images/privileges_hierarchy_database.svg b/modules/ROOT/images/privileges_hierarchy_database.svg
index 0ccfd067d..dbdf28cfb 100644
--- a/modules/ROOT/images/privileges_hierarchy_database.svg
+++ b/modules/ROOT/images/privileges_hierarchy_database.svg
@@ -1,9 +1 @@
-
+
\ No newline at end of file
diff --git a/modules/ROOT/pages/authentication-authorization/database-administration.adoc b/modules/ROOT/pages/authentication-authorization/database-administration.adoc
index b90723fd5..0582e255d 100644
--- a/modules/ROOT/pages/authentication-authorization/database-administration.adoc
+++ b/modules/ROOT/pages/authentication-authorization/database-administration.adoc
@@ -5,8 +5,10 @@
[source, cypher, role=test-setup]
----
CREATE ROLE regularUsers;
+CREATE ROLE alterDbUsers;
CREATE ROLE databaseAdminUsers;
CREATE DATABASE `remote-db`;
+CREATE COMPOSITE DATABASE `composite`;
CREATE USER jake SET PASSWORD 'abcd1234' CHANGE NOT REQUIRED;
----
////
@@ -72,7 +74,7 @@ This can be quite powerful as it allows permissions to be switched from one data
For more details about the syntax descriptions, see xref:database-administration/syntax.adoc[].
====
-.General grant +ON DATABASE+ privilege syntax
+.`GRANT ON DATABASE` privilege syntax
[cols="<15s,<85"]
|===
@@ -92,7 +94,7 @@ GRANT [IMMUTABLE] database-privilege ON { HOME DATABASE \| DATABASE[S] { * \| na
|===
-.General deny +ON DATABASE+ privilege syntax
+.`DENY ON DATABASE` privilege syntax
[cols="<15s,<85"]
|===
@@ -112,7 +114,7 @@ DENY [IMMUTABLE] database-privilege ON { HOME DATABASE \| DATABASE[S] { * \| nam
|===
-.General revoke +ON DATABASE+ privilege syntax
+.`REVOKE GRANT ON DATABASE` privilege syntax
[cols="<15s,<85"]
|===
@@ -132,7 +134,7 @@ REVOKE [IMMUTABLE] GRANT database-privilege ON { HOME DATABASE \| DATABASE[S] {
|===
-.General revoke +ON DATABASE+ privilege syntax
+.`REVOKE DENY ON DATABASE` privilege syntax
[cols="<15s,<85"]
|===
@@ -152,7 +154,7 @@ REVOKE [IMMUTABLE] DENY database-privilege ON { HOME DATABASE \| DATABASE[S] { *
|===
-.General revoke +ON DATABASE+ privilege syntax
+.`REVOKE ON DATABASE` privilege syntax
[cols="<15s,<85"]
|===
@@ -184,12 +186,13 @@ See link:{neo4j-docs-base-uri}/status-codes/{page-version}/notifications/all-not
The hierarchy between the different database privileges is shown in the image below.
+// TODO: do we want two pictures, one for Cypher 5 and one for Cypher 25? I'd guess not but I'm not sure
image::privileges_hierarchy_database.svg[title="Database privileges hierarchy"]
-.Database privilege syntax
+.`GRANT ACCESS` privilege syntax
[cols="<15s,<85"]
|===
@@ -216,7 +219,7 @@ Grants the specified roles the privilege to access:
|===
-.Database privilege syntax
+.`GRANT START | STOP` privilege syntax
[cols="<15s,<85"]
|===
@@ -237,8 +240,54 @@ GRANT [IMMUTABLE] { START \| STOP }
|===
+[role=label--new-2025.08 label--cypher-25]
+.`GRANT ALTER DATABASE | SET DATABASE ACCESS | SET DATABASE DEFAULT LANGUAGE` privilege syntax
+[cols="<15s,<85"]
+|===
+
+| Command
+m| +GRANT { ALTER DATABASE \| SET DATABASE ACCESS \| SET DATABASE DEFAULT LANGUAGE }+
+
+| Syntax
+a|
+[source, syntax, role="noheader", indent=0]
+----
+GRANT [IMMUTABLE] { ALTER DATABASE \| SET DATABASE ACCESS \| SET DATABASE DEFAULT LANGUAGE }
+ ON { HOME DATABASE \| DATABASE[S] {* \| name[, ...] } }
+ TO role[, ...]
+----
+
+| Description
+| Grants the specified roles the privilege to modify everything, database access or default language of the home database, specific database(s), or all databases.
+Only applies to standard databases.
+
+|===
+
+[role=label--new-2025.08 label--cypher-25]
+.`GRANT ALTER COMPOSITE DATABASE` privilege syntax
+[cols="<15s,<85"]
+|===
-.Database privilege syntax
+| Command
+m| +GRANT { ALTER COMPOSITE DATABASE }+
+
+| Syntax
+a|
+[source, syntax, role="noheader", indent=0]
+----
+GRANT [IMMUTABLE] { ALTER COMPOSITE DATABASE }
+ ON { HOME DATABASE \| DATABASE[S] {* \| name[, ...] } }
+ TO role[, ...]
+----
+
+| Description
+| Grants the specified roles the privilege to modify the home database, specific database(s), or all databases.
+Only applies to composite databases.
+
+|===
+
+
+.`GRANT CREATE | DROP | SHOW INDEX` privilege syntax
[cols="<15s,<85"]
|===
@@ -260,7 +309,7 @@ GRANT [IMMUTABLE] { CREATE \| DROP \| SHOW } INDEX[ES]
|===
-.Database privilege syntax
+.`GRANT INDEX` privilege syntax
[cols="<15s,<85"]
|===
@@ -282,7 +331,7 @@ GRANT [IMMUTABLE] INDEX[ES] [MANAGEMENT]
|===
-.Database privilege syntax
+.`GRANT CREATE | DROP | SHOW CONSTRAINT` privilege syntax
[cols="<15s,<85"]
|===
@@ -304,7 +353,7 @@ GRANT [IMMUTABLE] { CREATE \| DROP \| SHOW } CONSTRAINT[S]
|===
-.Database privilege syntax
+.`GRANT CONSTRAINT` privilege syntax
[cols="<15s,<85"]
|===
@@ -326,7 +375,7 @@ GRANT [IMMUTABLE] CONSTRAINT[S] [MANAGEMENT]
|===
-.Database privilege syntax
+.`GRANT CREATE NEW LABEL` privilege syntax
[cols="<15s,<85"]
|===
@@ -348,7 +397,7 @@ GRANT [IMMUTABLE] CREATE NEW [NODE] LABEL[S]
|===
-.Database privilege syntax
+.`GRANT CREATE NEW TYPE` privilege syntax
[cols="<15s,<85"]
|===
@@ -370,7 +419,7 @@ GRANT [IMMUTABLE] CREATE NEW [RELATIONSHIP] TYPE[S]
|===
-.Database privilege syntax
+.`GRANT CREATE NEW NAME` privilege syntax
[cols="<15s,<85"]
|===
@@ -392,7 +441,7 @@ GRANT [IMMUTABLE] CREATE NEW [PROPERTY] NAME[S]
|===
-.Database privilege syntax
+.`GRANT NAME` privilege syntax
[cols="<15s,<85"]
|===
@@ -414,7 +463,7 @@ GRANT [IMMUTABLE] NAME [MANAGEMENT]
|===
-.Database privilege syntax
+.`GRANT ALL` privilege syntax
[cols="<15s,<85"]
|===
@@ -436,7 +485,7 @@ GRANT [IMMUTABLE] ALL [[DATABASE] PRIVILEGES]
|===
-.Database privilege syntax
+.`GRANT { SHOW \| TERMINATE } TRANSACTION` privilege syntax
[cols="<15s,<85"]
|===
@@ -458,7 +507,7 @@ GRANT [IMMUTABLE] { SHOW \| TERMINATE } TRANSACTION[S] [( { * \| user[, ...] } )
|===
-.Database privilege syntax
+.`GRANT TRANSACTION` privilege syntax
[cols="<15s,<85"]
|===
@@ -479,8 +528,8 @@ GRANT [IMMUTABLE] TRANSACTION [MANAGEMENT] [( { * \| user[, ...] } )]
|===
-
-image::privileges_grant_and_deny_syntax_database_privileges.svg[title="Syntax of GRANT and DENY Database Privileges"]
+// TODO: do we want two pictures, one for Cypher 5 and one for Cypher 25? I'd guess not but I'm not sure
+image::privileges_grant_and_deny_syntax_database_privileges.svg[title="Syntax of `GRANT` and `DENY` database privileges"]
[[access-control-database-administration-access]]
@@ -564,7 +613,7 @@ DENY [IMMUTABLE] START
TO role[, ...]
----
-For example, to deny the role `regularUsers` the ability to start to the database `neo4j`, use:
+For example, to deny the role `regularUsers` the ability to start to the database `system`, use:
[source, cypher, role=noplay]
----
@@ -596,7 +645,7 @@ DENY [IMMUTABLE] STOP
TO role[, ...]
----
-For example, to deny the role `regularUsers` the ability to stop the database `neo4j`, use:
+For example, to deny the role `regularUsers` the ability to stop the database `system`, use:
[source, cypher, role=noplay]
----
@@ -628,6 +677,172 @@ a|Rows: 6
Note that `START` and `STOP` privileges are not included in the xref:authentication-authorization/database-administration.adoc#access-control-database-administration-all[`ALL DATABASE PRIVILEGES`].
====
+[role=label--new-2025.08 label--cypher-25]
+[[access-control-database-administration-alter-db]]
+== The alter database-related privileges
+
+The `ALTER DATABASE`, `SET DATABASE ACCESS`, `SET DATABASE DEFAULT LANGUAGE`, and `ALTER COMPOSITE DATABASE` privileges can be granted both as database privileges and as DBMS privileges.
+The DBMS privilege is equivalent to granting the database privilege for all databases, `DATABASE *`.
+For more information on the DBMS privilege versions, see xref:authentication-authorization/dbms-administration.adoc#access-control-dbms-administration-database-management[The `DBMS DATABASE MANAGEMENT` privileges].
+
+
+The `ALTER DATABASE` privilege is used to enable the ability to modify a standard database:
+
+[source, syntax, role="noheader"]
+----
+GRANT [IMMUTABLE] ALTER DATABASE
+ ON { HOME DATABASE | DATABASE[S] { * | name[, ...] } }
+ TO role[, ...]
+----
+
+For example, to grant the role `alterDbUsers` the ability to modify the database `neo4j`, use:
+
+[source, cypher, role=noplay]
+----
+GRANT ALTER DATABASE ON DATABASE neo4j TO alterDbUsers
+----
+
+The `ALTER DATABASE` privilege can also be denied:
+
+[source, syntax, role="noheader"]
+----
+DENY [IMMUTABLE] ALTER DATABASE
+ ON { HOME DATABASE | DATABASE[S] { * | name[, ...] } }
+ TO role[, ...]
+----
+
+For example, to deny the role `alterDbUsers` the ability to modify to the database `system`, use:
+
+[source, cypher, role=noplay]
+----
+DENY ALTER DATABASE ON DATABASE system TO alterDbUsers
+----
+
+The `SET DATABASE ACCESS` privilege can be used to enable the ability to modify access, read-only or read-write, to a standard database:
+
+[source, syntax, role="noheader"]
+----
+GRANT [IMMUTABLE] SET DATABASE ACCESS
+ ON { HOME DATABASE | DATABASE[S] { * | name[, ...] } }
+ TO role[, ...]
+----
+
+This should not be confused with the `ACCESS` privileges that enables the ability for a user to access a database.
+
+For example, to grant the role `alterDbUsers` the ability to modify the access of the database `neo4j`, use:
+
+[source, cypher, role=noplay]
+----
+GRANT SET DATABASE ACCESS ON DATABASE neo4j TO alterDbUsers
+----
+
+The `SET DATABASE ACCESS` privilege can also be denied:
+
+[source, syntax, role="noheader"]
+----
+DENY [IMMUTABLE] SET DATABASE ACCESS
+ ON { HOME DATABASE | DATABASE[S] { * | name[, ...] } }
+ TO role[, ...]
+----
+
+For example, to deny the role `alterDbUsers` the ability to modify the access of the database `neo4j`, use:
+
+[source, cypher, role=noplay]
+----
+DENY SET DATABASE ACCESS ON DATABASE neo4j TO alterDbUsers
+----
+
+The `SET DATABASE DEFAULT LANGUAGE` privilege can be used to enable the ability to modify the default language of a standard database:
+
+[source, syntax, role="noheader"]
+----
+GRANT [IMMUTABLE] SET DATABASE DEFAULT LANGUAGE
+ ON { HOME DATABASE | DATABASE[S] { * | name[, ...] } }
+ TO role[, ...]
+----
+
+For example, to grant the role `alterDbUsers` the ability to modify the default Cypher language version of the database `neo4j`, use:
+
+[source, cypher, role=noplay]
+----
+GRANT SET DATABASE DEFAULT LANGUAGE ON DATABASE neo4j TO alterDbUsers
+----
+
+The `SET DATABASE DEFAULT LANGUAGE` privilege can also be denied:
+
+[source, syntax, role="noheader"]
+----
+DENY [IMMUTABLE] SET DATABASE DEFAULT LANGUAGE
+ ON { HOME DATABASE | DATABASE[S] { * | name[, ...] } }
+ TO role[, ...]
+----
+
+For example, to deny the role `alterDbUsers` the ability to modify the default language of the database `system`, use:
+
+[source, cypher, role=noplay]
+----
+DENY SET DATABASE DEFAULT LANGUAGE ON DATABASE system TO alterDbUsers
+----
+
+The `ALTER COMPOSITE DATABASE` privilege can be used to enable the ability to modify a composite database:
+
+[source, syntax, role="noheader"]
+----
+GRANT [IMMUTABLE] ALTER COMPOSITE DATABASE
+ ON { HOME DATABASE | DATABASE[S] { * | name[, ...] } }
+ TO role[, ...]
+----
+
+For example, to grant the role `alterDbUsers` the ability to modify the home database as long as it's a composite database, use:
+
+[source, cypher, role=noplay]
+----
+GRANT ALTER COMPOSITE DATABASE ON HOME DATABASE TO alterDbUsers
+----
+
+The `ALTER COMPOSITE DATABASE` privilege can also be denied:
+
+[source, syntax, role="noheader"]
+----
+DENY [IMMUTABLE] ALTER COMPOSITE DATABASE
+ ON { HOME DATABASE | DATABASE[S] { * | name[, ...] } }
+ TO role[, ...]
+----
+
+For example, to deny the role `alterDbUsers` the ability to modify to the composite database `composite`, use:
+
+[source, cypher, role=noplay]
+----
+DENY ALTER COMPOSITE DATABASE ON DATABASE composite TO alterDbUsers
+----
+
+The privileges granted can be seen using the `SHOW PRIVILEGES` command:
+
+[source, cypher, role=noplay]
+----
+SHOW ROLE alterDbUsers PRIVILEGES AS COMMANDS
+----
+
+.Result
+[options="header,footer", width="100%", cols="m"]
+|===
+|command
+|"DENY ALTER COMPOSITE DATABASE ON DATABASE `composite` TO `alterDbUsers`"
+|"DENY ALTER DATABASE ON DATABASE `system` TO `alterDbUsers`"
+|"DENY SET DATABASE ACCESS ON DATABASE `neo4j` TO `alterDbUsers`"
+|"DENY SET DATABASE DEFAULT LANGUAGE ON DATABASE `system` TO `alterDbUsers`"
+|"GRANT ALTER COMPOSITE DATABASE ON HOME DATABASE TO `alterDbUsers`"
+|"GRANT ALTER DATABASE ON DATABASE `neo4j` TO `alterDbUsers`"
+|"GRANT SET DATABASE ACCESS ON DATABASE `neo4j` TO `alterDbUsers`"
+|"GRANT SET DATABASE DEFAULT LANGUAGE ON DATABASE `neo4j` TO `alterDbUsers`"
+a|Rows: 8
+|===
+
+[NOTE]
+====
+Note that `ALTER DATABASE`, `SET DATABASE ACCESS`, `SET DATABASE DEFAULT LANGUAGE`, and `ALTER COMPOSITE DATABASE` privileges are not included in the xref:authentication-authorization/database-administration.adoc#access-control-database-administration-all[`ALL DATABASE PRIVILEGES`].
+====
+
[[access-control-database-administration-index]]
== The `INDEX MANAGEMENT` privileges
@@ -873,7 +1088,7 @@ GRANT [IMMUTABLE] ALL [[DATABASE] PRIVILEGES]
[NOTE]
====
-Note that the privileges for starting and stopping all databases, and transaction management, are not included in the `ALL DATABASE PRIVILEGES` grant.
+Note that the privileges for starting, stopping, and modifying all databases, and transaction management, are not included in the `ALL DATABASE PRIVILEGES` grant.
These privileges are associated with administrators while other database privileges are of use to domain and application developers.
====
@@ -906,7 +1121,7 @@ a|Rows: 1
The right to run the commands `SHOW TRANSACTIONS`, `TERMINATE TRANSACTIONS`, and the deprecated procedures `dbms.listTransactions`, `dbms.listQueries`, `dbms.killQuery`, `dbms.killQueries`, `dbms.killTransaction` and `dbms.killTransactions` is now managed through the `SHOW TRANSACTION` and `TERMINATE TRANSACTION` privileges.
-.Database privilege syntax
+.`GRANT SHOW TRANSACTION` privilege syntax
[cols="<15s,<85"]
|===
@@ -928,7 +1143,7 @@ GRANT [IMMUTABLE] SHOW TRANSACTION[S] [( { * \| user[, ...] } )]
|===
-.Database privilege syntax
+.`GRANT TERMINATE TRANSACTION` privilege syntax
[cols="<15s,<85"]
|===
@@ -950,7 +1165,7 @@ GRANT [IMMUTABLE] TERMINATE TRANSACTION[S] [( { * \| user[, ...] } )]
|===
-.Database privilege syntax
+.`GRANT TRANSACTION` privilege syntax
[cols="<15s,<85"]
|===
diff --git a/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc b/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
index c0d7206ff..4869f4a6f 100644
--- a/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
+++ b/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
@@ -1070,6 +1070,13 @@ GRANT [IMMUTABLE] DATABASE MANAGEMENT
|===
+[NOTE]
+====
+From Cypher 25 (Neo4j server 2025.08), the `ALTER DATABASE`, `SET DATABASE ACCESS`, `SET DATABASE DEFAULT LANGUAGE`, and `ALTER COMPOSITE DATABASE` privileges can be granted both as database privileges and as DBMS privileges.
+The DBMS privilege version is equivalent to granting the privilege for all databases, `DATABASE *`.
+For more information on the database privilege versions, see xref:authentication-authorization/database-administration.adoc#access-control-database-administration-alter-db[The alter database-related privileges].
+====
+
=== Grant privilege to create standard databases
You can grant the privilege to create standard databases using the `CREATE DATABASE` privilege. +
@@ -1200,6 +1207,13 @@ SHOW ROLE databaseModifier PRIVILEGES AS COMMANDS;
a|Rows: 1
|===
+[NOTE]
+====
+From Cypher 25 (Neo4j server 2025.08), the `ALTER DATABASE` privileges can be granted both as database privileges and as DBMS privileges.
+The DBMS privilege version is equivalent to granting the privilege for all databases, `DATABASE *`.
+For more information on the database privilege versions, see xref:authentication-authorization/database-administration.adoc#access-control-database-administration-alter-db[The alter database-related privileges].
+====
+
=== Grant privilege to modify access to standard databases
You can grant the privilege to modify access to standard databases using the `SET DATABASE ACCESS` privilege. +
@@ -1226,7 +1240,14 @@ SHOW ROLE accessModifier PRIVILEGES AS COMMANDS;
a|Rows: 1
|===
-[rol=label--new-2025.06]
+[NOTE]
+====
+From Cypher 25 (Neo4j server 2025.08), the `SET DATABASE ACCESS` privileges can be granted both as database privileges and as DBMS privileges.
+The DBMS privilege version is equivalent to granting the privilege for all databases, `DATABASE *`.
+For more information on the database privilege versions, see xref:authentication-authorization/database-administration.adoc#access-control-database-administration-alter-db[The alter database-related privileges].
+====
+
+[role=label--new-2025.06]
=== Grant privilege to modify the default language of standard databases
You can grant the privilege to modify the default language of standard databases using the `SET DATABASE DEFAULT LANGUAGE` privilege. +
@@ -1253,7 +1274,14 @@ SHOW ROLE languageModifier PRIVILEGES AS COMMANDS;
a|Rows: 1
|===
-[rol=label--new-2025.06]
+[NOTE]
+====
+From Cypher 25 (Neo4j server 2025.08), the `SET DATABASE DEFAULT LANGUAGE` privileges can be granted both as database privileges and as DBMS privileges.
+The DBMS privilege version is equivalent to granting the privilege for all databases, `DATABASE *`.
+For more information on the database privilege versions, see xref:authentication-authorization/database-administration.adoc#access-control-database-administration-alter-db[The alter database-related privileges].
+====
+
+[role=label--new-2025.06]
[[grant-privilege-alter-composite-database]]
=== Grant privilege to modify composite databases
@@ -1281,6 +1309,13 @@ SHOW ROLE compositeDatabaseModifier PRIVILEGES AS COMMANDS;
a|Rows: 1
|===
+[NOTE]
+====
+From Cypher 25 (Neo4j server 2025.08), the `ALTER COMPOSITE DATABASE` privileges can be granted both as database privileges and as DBMS privileges.
+The DBMS privilege version is equivalent to granting the privilege for all databases, `DATABASE *`.
+For more information on the database privilege versions, see xref:authentication-authorization/database-administration.adoc#access-control-database-administration-alter-db[The alter database-related privileges].
+====
+
=== Grant privilege to manage composite databases
You can grant the privilege to create, delete, and modify composite databases using the `COMPOSITE DATABASE MANAGEMENT` privilege. +