diff --git a/include/common/tgrant.h b/include/common/tgrant.h
index ad23c661b1e76b12128a2946db76f2ce44ed7663..09c6e5378efb046af6acbc329e2435d8a8965a90 100644
--- a/include/common/tgrant.h
+++ b/include/common/tgrant.h
@@ -21,6 +21,7 @@ extern "C" {
 #endif
 
 #include "os.h"
+#include "taoserror.h"
 
 typedef enum {
   TSDB_GRANT_ALL,
diff --git a/source/common/src/tgrant.c b/source/common/src/tgrant.c
new file mode 100644
index 0000000000000000000000000000000000000000..74a59fd5804787b4060033281d8a0f52841ff143
--- /dev/null
+++ b/source/common/src/tgrant.c
@@ -0,0 +1,23 @@
+/*
+ * Copyright (c) 2019 TAOS Data, Inc. <jhtao@taosdata.com>
+ *
+ * This program is free software: you can use, redistribute, and/or modify
+ * it under the terms of the GNU Affero General Public License, version 3
+ * or later ("AGPL"), as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#define _DEFAULT_SOURCE
+#include "tgrant.h"
+
+#ifndef _GRANT
+
+int32_t grantCheck(EGrantType grant) { return TSDB_CODE_SUCCESS; }
+
+#endif
\ No newline at end of file
diff --git a/source/dnode/mnode/impl/src/mndFunc.c b/source/dnode/mnode/impl/src/mndFunc.c
index b626c1fb04e230ca86480159ea016f398ccd90aa..e6f4b485242d375fd635f1067acca4a3f2083423 100644
--- a/source/dnode/mnode/impl/src/mndFunc.c
+++ b/source/dnode/mnode/impl/src/mndFunc.c
@@ -190,6 +190,10 @@ static int32_t mndCreateFunc(SMnode *pMnode, SRpcMsg *pReq, SCreateFuncReq *pCre
   int32_t code = -1;
   STrans *pTrans = NULL;
 
+  if ((terrno = grantCheck(TSDB_GRANT_USER)) < 0) {
+    return code;
+  }
+
   SFuncObj func = {0};
   memcpy(func.name, pCreate->name, TSDB_FUNC_NAME_LEN);
   func.createdTime = taosGetTimestampMs();
diff --git a/source/dnode/mnode/impl/src/mndGrant.c b/source/dnode/mnode/impl/src/mndGrant.c
index 1148fd740b40a611c1f8f507c45d2e917345faeb..a608a1e40f800b7fe4cf334d0e27110b7eaa50fe 100644
--- a/source/dnode/mnode/impl/src/mndGrant.c
+++ b/source/dnode/mnode/impl/src/mndGrant.c
@@ -128,7 +128,6 @@ int32_t mndInitGrant(SMnode *pMnode) {
 
 void    mndCleanupGrant() {}
 void    grantParseParameter() { mError("can't parsed parameter k"); }
-int32_t grantCheck(EGrantType grant) { return TSDB_CODE_SUCCESS; }
 void    grantReset(SMnode *pMnode, EGrantType grant, uint64_t value) {}
 void    grantAdd(EGrantType grant, uint64_t value) {}
 void    grantRestore(EGrantType grant, uint64_t value) {}
diff --git a/source/dnode/vnode/src/vnd/vnodeSvr.c b/source/dnode/vnode/src/vnd/vnodeSvr.c
index 5463f42f6af608942e8aa6db18dd05189e401767..9d06fbffdd961f51f7a8c153eae8879411b70919 100644
--- a/source/dnode/vnode/src/vnd/vnodeSvr.c
+++ b/source/dnode/vnode/src/vnd/vnodeSvr.c
@@ -477,6 +477,11 @@ static int32_t vnodeProcessCreateTbReq(SVnode *pVnode, int64_t version, void *pR
   for (int32_t iReq = 0; iReq < req.nReqs; iReq++) {
     pCreateReq = req.pReqs + iReq;
 
+    if ((terrno = grantCheck(TSDB_GRANT_TIMESERIES)) < 0) {
+      rcode = -1;
+      goto _exit;
+    }
+    
     // validate hash
     sprintf(tbName, "%s.%s", pVnode->config.dbname, pCreateReq->name);
     if (vnodeValidateTableHash(pVnode, tbName) < 0) {
@@ -821,6 +826,13 @@ static int32_t vnodeProcessSubmitReq(SVnode *pVnode, int64_t version, void *pReq
         goto _exit;
       }
 
+      if ((terrno = grantCheck(TSDB_GRANT_TIMESERIES)) < 0) {
+        pRsp->code = terrno;
+        tDecoderClear(&decoder);
+        taosArrayDestroy(createTbReq.ctb.tagName);
+        goto _exit;
+      }
+
       if (metaCreateTable(pVnode->pMeta, version, &createTbReq) < 0) {
         if (terrno != TSDB_CODE_TDB_TABLE_ALREADY_EXIST) {
           submitBlkRsp.code = terrno;