DCL (Data Control Language)

DCL is the subset of SQL that manages permissions — GRANT and REVOKE — controlling which users or roles can access or modify which database objects.

GRANT SELECT ON employees TO reporting_role; gives read access without allowing modification; REVOKE removes previously granted privileges. DCL enforces the principle of least privilege at the database layer — independent of, and in addition to, any access control an application built on top of the database implements.

GRANT SELECT, INSERT ON employees TO app_user;
REVOKE INSERT ON employees FROM app_user;