diff --git a/modules/ROOT/images/privileges_grant_and_deny_syntax_database_privileges.svg b/modules/ROOT/images/privileges_grant_and_deny_syntax_database_privileges.svg
index 4e0babc35..59ffa7f49 100644
--- a/modules/ROOT/images/privileges_grant_and_deny_syntax_database_privileges.svg
+++ b/modules/ROOT/images/privileges_grant_and_deny_syntax_database_privileges.svg
@@ -1,99 +1 @@
-
+
\ No newline at end of file
diff --git a/modules/ROOT/images/privileges_hierarchy_database.svg b/modules/ROOT/images/privileges_hierarchy_database.svg
index 0ccfd067d..dbdf28cfb 100644
--- a/modules/ROOT/images/privileges_hierarchy_database.svg
+++ b/modules/ROOT/images/privileges_hierarchy_database.svg
@@ -1,9 +1 @@
-
+
\ No newline at end of file
diff --git a/modules/ROOT/pages/authentication-authorization/database-administration.adoc b/modules/ROOT/pages/authentication-authorization/database-administration.adoc
index b90723fd5..0377bf483 100644
--- a/modules/ROOT/pages/authentication-authorization/database-administration.adoc
+++ b/modules/ROOT/pages/authentication-authorization/database-administration.adoc
@@ -5,8 +5,10 @@
[source, cypher, role=test-setup]
----
CREATE ROLE regularUsers;
+CREATE ROLE alterDbUsers;
CREATE ROLE databaseAdminUsers;
CREATE DATABASE `remote-db`;
+CREATE COMPOSITE DATABASE `composite`;
CREATE USER jake SET PASSWORD 'abcd1234' CHANGE NOT REQUIRED;
----
////
@@ -184,6 +186,7 @@ See link:{neo4j-docs-base-uri}/status-codes/{page-version}/notifications/all-not
The hierarchy between the different database privileges is shown in the image below.
+// TODO: do we want two pictures, one for Cypher 5 and one for Cypher 25? I'd guess not but I'm not sure
image::privileges_hierarchy_database.svg[title="Database privileges hierarchy"]
@@ -237,6 +240,52 @@ GRANT [IMMUTABLE] { START \| STOP }
|===
+[role=label--new-2025.08]
+.Database privilege syntax
+[cols="<15s,<85"]
+|===
+
+| Command
+m| +GRANT { ALTER DATABASE \| SET DATABASE ACCESS \| SET DATABASE DEFAULT LANGUAGE }+
+
+| Syntax
+a|
+[source, syntax, role="noheader", indent=0]
+----
+GRANT [IMMUTABLE] { ALTER DATABASE \| SET DATABASE ACCESS \| SET DATABASE DEFAULT LANGUAGE }
+ ON { HOME DATABASE \| DATABASE[S] {* \| name[, ...] } }
+ TO role[, ...]
+----
+
+| Description
+| Grants the specified roles the privilege to modify everything, database access or default language of the home database, specific database(s), or all databases.
+Only applies to standard databases.
+
+|===
+
+[role=label--new-2025.08]
+.Database privilege syntax
+[cols="<15s,<85"]
+|===
+
+| Command
+m| +GRANT { ALTER COMPOSITE DATABASE }+
+
+| Syntax
+a|
+[source, syntax, role="noheader", indent=0]
+----
+GRANT [IMMUTABLE] { ALTER COMPOSITE DATABASE }
+ ON { HOME DATABASE \| DATABASE[S] {* \| name[, ...] } }
+ TO role[, ...]
+----
+
+| Description
+| Grants the specified roles the privilege to modify the home database, specific database(s), or all databases.
+Only applies to composite databases.
+
+|===
+
.Database privilege syntax
[cols="<15s,<85"]
@@ -479,7 +528,7 @@ GRANT [IMMUTABLE] TRANSACTION [MANAGEMENT] [( { * \| user[, ...] } )]
|===
-
+// TODO: do we want two pictures, one for Cypher 5 and one for Cypher 25? I'd guess not but I'm not sure
image::privileges_grant_and_deny_syntax_database_privileges.svg[title="Syntax of GRANT and DENY Database Privileges"]
@@ -564,7 +613,7 @@ DENY [IMMUTABLE] START
TO role[, ...]
----
-For example, to deny the role `regularUsers` the ability to start to the database `neo4j`, use:
+For example, to deny the role `regularUsers` the ability to start to the database `system`, use:
[source, cypher, role=noplay]
----
@@ -596,7 +645,7 @@ DENY [IMMUTABLE] STOP
TO role[, ...]
----
-For example, to deny the role `regularUsers` the ability to stop the database `neo4j`, use:
+For example, to deny the role `regularUsers` the ability to stop the database `system`, use:
[source, cypher, role=noplay]
----
@@ -628,6 +677,172 @@ a|Rows: 6
Note that `START` and `STOP` privileges are not included in the xref:authentication-authorization/database-administration.adoc#access-control-database-administration-all[`ALL DATABASE PRIVILEGES`].
====
+[role=label--new-2025.08]
+[[access-control-database-administration-alter-db]]
+== The alter database related privileges
+
+The `ALTER DATABASE`, `SET DATABASE ACCESS`, `SET DATABASE DEFAULT LANGUAGE`, and `ALTER COMPOSITE DATABASE` privileges can be granted both as database privileges and as DBMS privileges.
+The DBMS privilege is equivalent to granting the database privilege for all databases, `DATABASE *`.
+For more information on the DBMS privilege versions, see the xref:authentication-authorization/dbms-administration.adoc#access-control-dbms-administration-database-management[`DATABASE MANAGEMENT` privileges].
+
+
+The `ALTER DATABASE` privilege is used to enable the ability to modify a standard database:
+
+[source, syntax, role="noheader"]
+----
+GRANT [IMMUTABLE] ALTER DATABASE
+ ON { HOME DATABASE | DATABASE[S] { * | name[, ...] } }
+ TO role[, ...]
+----
+
+For example, to grant the role `alterDbUsers` the ability to modify the database `neo4j`, use:
+
+[source, cypher, role=noplay]
+----
+GRANT ALTER DATABASE ON DATABASE neo4j TO alterDbUsers
+----
+
+The `ALTER DATABASE` privilege can also be denied:
+
+[source, syntax, role="noheader"]
+----
+DENY [IMMUTABLE] ALTER DATABASE
+ ON { HOME DATABASE | DATABASE[S] { * | name[, ...] } }
+ TO role[, ...]
+----
+
+For example, to deny the role `alterDbUsers` the ability to modify to the database `system`, use:
+
+[source, cypher, role=noplay]
+----
+DENY ALTER DATABASE ON DATABASE system TO alterDbUsers
+----
+
+The `SET DATABASE ACCESS` privilege can be used to enable the ability to modify access, read-only or read-write, to a standard database:
+
+[source, syntax, role="noheader"]
+----
+GRANT [IMMUTABLE] SET DATABASE ACCESS
+ ON { HOME DATABASE | DATABASE[S] { * | name[, ...] } }
+ TO role[, ...]
+----
+
+This should not be confused with the `ACCESS` privileges that enables the ability for a user to access a database.
+
+For example, to grant the role `alterDbUsers` the ability to modify the access of the database `neo4j`, use:
+
+[source, cypher, role=noplay]
+----
+GRANT SET DATABASE ACCESS ON DATABASE neo4j TO alterDbUsers
+----
+
+The `SET DATABASE ACCESS` privilege can also be denied:
+
+[source, syntax, role="noheader"]
+----
+DENY [IMMUTABLE] SET DATABASE ACCESS
+ ON { HOME DATABASE | DATABASE[S] { * | name[, ...] } }
+ TO role[, ...]
+----
+
+For example, to deny the role `alterDbUsers` the ability to modify the access of the database `neo4j`, use:
+
+[source, cypher, role=noplay]
+----
+DENY SET DATABASE ACCESS ON DATABASE neo4j TO alterDbUsers
+----
+
+The `SET DATABASE DEFAULT LANGUAGE` privilege can be used to enable the ability to modify the default language of a standard database:
+
+[source, syntax, role="noheader"]
+----
+GRANT [IMMUTABLE] SET DATABASE DEFAULT LANGUAGE
+ ON { HOME DATABASE | DATABASE[S] { * | name[, ...] } }
+ TO role[, ...]
+----
+
+For example, to grant the role `alterDbUsers` the ability to modify the default Cypher language version of the database `neo4j`, use:
+
+[source, cypher, role=noplay]
+----
+GRANT SET DATABASE DEFAULT LANGUAGE ON DATABASE neo4j TO alterDbUsers
+----
+
+The `SET DATABASE DEFAULT LANGUAGE` privilege can also be denied:
+
+[source, syntax, role="noheader"]
+----
+DENY [IMMUTABLE] SET DATABASE DEFAULT LANGUAGE
+ ON { HOME DATABASE | DATABASE[S] { * | name[, ...] } }
+ TO role[, ...]
+----
+
+For example, to deny the role `alterDbUsers` the ability to modify the default language of the database `system`, use:
+
+[source, cypher, role=noplay]
+----
+DENY SET DATABASE DEFAULT LANGUAGE ON DATABASE system TO alterDbUsers
+----
+
+The `ALTER COMPOSITE DATABASE` privilege can be used to enable the ability to modify a composite database:
+
+[source, syntax, role="noheader"]
+----
+GRANT [IMMUTABLE] ALTER COMPOSITE DATABASE
+ ON { HOME DATABASE | DATABASE[S] { * | name[, ...] } }
+ TO role[, ...]
+----
+
+For example, to grant the role `alterDbUsers` the ability to modify the home database as long as it's a composite database, use:
+
+[source, cypher, role=noplay]
+----
+GRANT ALTER COMPOSITE DATABASE ON HOME DATABASE TO alterDbUsers
+----
+
+The `ALTER COMPOSITE DATABASE` privilege can also be denied:
+
+[source, syntax, role="noheader"]
+----
+DENY [IMMUTABLE] ALTER COMPOSITE DATABASE
+ ON { HOME DATABASE | DATABASE[S] { * | name[, ...] } }
+ TO role[, ...]
+----
+
+For example, to deny the role `alterDbUsers` the ability to modify to the composite database `composite`, use:
+
+[source, cypher, role=noplay]
+----
+DENY ALTER COMPOSITE DATABASE ON DATABASE composite TO alterDbUsers
+----
+
+The privileges granted can be seen using the `SHOW PRIVILEGES` command:
+
+[source, cypher, role=noplay]
+----
+SHOW ROLE alterDbUsers PRIVILEGES AS COMMANDS
+----
+
+.Result
+[options="header,footer", width="100%", cols="m"]
+|===
+|command
+|"DENY ALTER COMPOSITE DATABASE ON DATABASE `composite` TO `alterDbUsers`"
+|"DENY ALTER DATABASE ON DATABASE `system` TO `alterDbUsers`"
+|"DENY SET DATABASE ACCESS ON DATABASE `neo4j` TO `alterDbUsers`"
+|"DENY SET DATABASE DEFAULT LANGUAGE ON DATABASE `system` TO `alterDbUsers`"
+|"GRANT ALTER COMPOSITE DATABASE ON HOME DATABASE TO `alterDbUsers`"
+|"GRANT ALTER DATABASE ON DATABASE `neo4j` TO `alterDbUsers`"
+|"GRANT SET DATABASE ACCESS ON DATABASE `neo4j` TO `alterDbUsers`"
+|"GRANT SET DATABASE DEFAULT LANGUAGE ON DATABASE `neo4j` TO `alterDbUsers`"
+a|Rows: 8
+|===
+
+[NOTE]
+====
+Note that `ALTER DATABASE`, `SET DATABASE ACCESS`, `SET DATABASE DEFAULT LANGUAGE`, and `ALTER COMPOSITE DATABASE` privileges are not included in the xref:authentication-authorization/database-administration.adoc#access-control-database-administration-all[`ALL DATABASE PRIVILEGES`].
+====
+
[[access-control-database-administration-index]]
== The `INDEX MANAGEMENT` privileges
@@ -873,7 +1088,7 @@ GRANT [IMMUTABLE] ALL [[DATABASE] PRIVILEGES]
[NOTE]
====
-Note that the privileges for starting and stopping all databases, and transaction management, are not included in the `ALL DATABASE PRIVILEGES` grant.
+Note that the privileges for starting, stopping and modifying all databases, and transaction management, are not included in the `ALL DATABASE PRIVILEGES` grant.
These privileges are associated with administrators while other database privileges are of use to domain and application developers.
====
diff --git a/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc b/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
index c0d7206ff..317b03b85 100644
--- a/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
+++ b/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc
@@ -1070,6 +1070,10 @@ GRANT [IMMUTABLE] DATABASE MANAGEMENT
|===
+From Cypher 25, the `ALTER DATABASE`, `SET DATABASE ACCESS`, `SET DATABASE DEFAULT LANGUAGE`, and `ALTER COMPOSITE DATABASE` privileges can be granted both as database privileges and as DBMS privileges.
+The DBMS privilege version is equivalent to granting the privilege for all databases, `DATABASE *`.
+For more information on the database privilege versions, see the xref:authentication-authorization/database-administration.adoc#access-control-database-administration-alter-db[alter database privileges].
+
=== Grant privilege to create standard databases
You can grant the privilege to create standard databases using the `CREATE DATABASE` privilege. +
@@ -1200,6 +1204,10 @@ SHOW ROLE databaseModifier PRIVILEGES AS COMMANDS;
a|Rows: 1
|===
+From Cypher 25, this privilege can be granted both as database privilege and as DBMS privilege.
+The DBMS privilege version is equivalent to granting the privilege for all databases, `DATABASE *`.
+For more information on the database privilege version, see the xref:authentication-authorization/database-administration.adoc#access-control-database-administration-alter-db[alter database privileges].
+
=== Grant privilege to modify access to standard databases
You can grant the privilege to modify access to standard databases using the `SET DATABASE ACCESS` privilege. +
@@ -1226,7 +1234,11 @@ SHOW ROLE accessModifier PRIVILEGES AS COMMANDS;
a|Rows: 1
|===
-[rol=label--new-2025.06]
+From Cypher 25, this privilege can be granted both as database privilege and as DBMS privilege.
+The DBMS privilege version is equivalent to granting the privilege for all databases, `DATABASE *`.
+For more information on the database privilege version, see the xref:authentication-authorization/database-administration.adoc#access-control-database-administration-alter-db[alter database privileges].
+
+[role=label--new-2025.06]
=== Grant privilege to modify the default language of standard databases
You can grant the privilege to modify the default language of standard databases using the `SET DATABASE DEFAULT LANGUAGE` privilege. +
@@ -1253,7 +1265,11 @@ SHOW ROLE languageModifier PRIVILEGES AS COMMANDS;
a|Rows: 1
|===
-[rol=label--new-2025.06]
+From Cypher 25, this privilege can be granted both as database privilege and as DBMS privilege.
+The DBMS privilege version is equivalent to granting the privilege for all databases, `DATABASE *`.
+For more information on the database privilege version, see the xref:authentication-authorization/database-administration.adoc#access-control-database-administration-alter-db[alter database privileges].
+
+[role=label--new-2025.06]
[[grant-privilege-alter-composite-database]]
=== Grant privilege to modify composite databases
@@ -1281,6 +1297,10 @@ SHOW ROLE compositeDatabaseModifier PRIVILEGES AS COMMANDS;
a|Rows: 1
|===
+From Cypher 25, this privilege can be granted both as database privilege and as DBMS privilege.
+The DBMS privilege version is equivalent to granting the privilege for all databases, `DATABASE *`.
+For more information on the database privilege version, see the xref:authentication-authorization/database-administration.adoc#access-control-database-administration-alter-db[alter database privileges].
+
=== Grant privilege to manage composite databases
You can grant the privilege to create, delete, and modify composite databases using the `COMPOSITE DATABASE MANAGEMENT` privilege. +