neo4j-security-skill

Manages Neo4j users, roles, privileges, and auth providers via Cypher on the system database.

Updated Aug 25, 2026
One-click install
npx skills add https://github.com/cardox6/steuer-graph --skill neo4j-security-skill-cardox6
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: neo4j-security-skill
Source: https://github.com/cardox6/steuer-graph/tree/main/.agents/skills/neo4j-security-skill
Command: npx skills add https://github.com/cardox6/steuer-graph --skill neo4j-security-skill-cardox6

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Configuring Neo4j access control requires precise Cypher syntax across users, roles, privileges, and auth providers, and mistakes can lock out users or expose sensitive data. This Skill provides verified command patterns and decision tables so agents can manage security programmatically without syntax errors. ## Core Features & Use Cases - User and Role Lifecycle: Create, alter, suspend, and drop users; create roles and grant or revoke role membership with bulk operations. - Privilege Management: GRANT, DENY, and REVOKE graph, database, and DBMS privileges, including property-level and sub-graph access control for Enterprise Edition. - ABAC and Auth Providers: Create attribute-based access control rules from OIDC claims or native user tags, plus reference configuration for LDAP and OIDC/SSO. - Use Case: A security admin needs a read-only analyst role that can see Person nodes but not their ssn property. The Skill provides the exact GRANT MATCH plus DENY READ {ssn} sequence and a SHOW PRIVILEGES verification step. ## Quick Start Ask the agent to create a read-only analyst role on your Neo4j database that hides sensitive properties, and it will generate the exact Cypher commands for your confirmation before execution.

Frequently Asked Questions about neo4j-security-skill

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I create a read-only user role in Neo4j?▼

Create a role with CREATE ROLE, then grant ACCESS on the database and MATCH {*} on the graph elements. Assign it to users with GRANT ROLE analyst TO alice, and verify with SHOW ROLE analyst PRIVILEGES AS COMMANDS.

How to hide specific properties from a Neo4j role?▼

Grant MATCH on the node label, then use DENY READ {property} for the sensitive properties, since DENY overrides GRANT. Property-level access control requires Neo4j Enterprise Edition.

Does Neo4j Community Edition support role-based access control?▼

Community Edition supports basic RBAC with users, roles, and privileges. Property-level security, sub-graph pattern restrictions, ABAC, LDAP, and OIDC/SSO integration all require Enterprise Edition.

What is the difference between GRANT, DENY, and REVOKE in Neo4j?▼

GRANT allows a privilege, DENY explicitly blocks it and overrides any GRANT, and REVOKE removes an existing grant or deny. REVOKE without a qualifier removes both the grant and deny for that privilege.

How does attribute-based access control work in Neo4j?▼

ABAC uses CREATE AUTH RULE with conditions on OIDC claims via abac.oidc.user_attribute() or native user tags via abac.native.user_tags(). Roles granted to an auth rule apply dynamically to users whose claims satisfy the condition.

Why does a Neo4j user get connection refused despite having graph privileges?▼

The role is missing ACCESS ON DATABASE, which is required before any graph privileges take effect. Grant it with GRANT ACCESS ON DATABASE mydb TO role, then verify with SHOW USER privileges.