<Admonition type="tip">

To modify an existing user to provide access to the Database Access service, see [Database Access Access Controls](../../database-access/rbac.mdx)

</Admonition>

Create a local Teleport user with the built-in `access` role:

```code
$ tctl users add \
  --roles=access \
  --db-users=\* \
  --db-names=\* \
  alice
```

| Flag                      | Description                                                                                                                              |
|---------------------------|------------------------------------------------------------------------------------------------------------------------------------------|
| <nobr>`--roles`</nobr>    | List of roles to assign to the user. The builtin `access` role allows them to connect to any database server registered with Teleport.   |
| <nobr>`--db-users`</nobr> | List of database usernames the user will be allowed to use when connecting to the databases. A wildcard allows any user.                 |
| <nobr>`--db-names`</nobr> | List of logical databases (aka schemas) the user will be allowed to connect to within a database server. A wildcard allows any database. |

<Admonition type="warning">
  Database names are only enforced for PostgreSQL and MongoDB databases.
</Admonition>

For more detailed information about database access controls and how to restrict
access see [RBAC](../../database-access/rbac.mdx) documentation.