apache/cassandra · error · InvalidRequestException

Altering permissions on builtin functions is not supported

Error message

Altering permissions on builtin functions is not supported

What it means

FunctionResource.validate rejects any function-level resource whose keyspace is the system keyspace. Granting or revoking permissions on built-in system functions is not permitted, so the operation fails with InvalidRequestException before touching the permissions store.

Source

Thrown at src/java/org/apache/cassandra/auth/FunctionResource.java:310

        switch (level)
        {
            case ROOT:
            case KEYSPACE:
                return COLLECTION_LEVEL_PERMISSIONS;
            case FUNCTION:
            {
                Optional<UserFunction> function = Schema.instance.findUserFunction(getFunctionName(), argTypes);
                assert function.isPresent() : "Unable to find function object for resource " + toString();
                return function.get().isAggregate() ? AGGREGATE_FUNCTION_PERMISSIONS : SCALAR_FUNCTION_PERMISSIONS;
            }
        }
        throw new AssertionError();
    }

    private void validate()
    {
        if (SchemaConstants.SYSTEM_KEYSPACE_NAME.equals(keyspace))
            throw new InvalidRequestException("Altering permissions on builtin functions is not supported");
    }

    public int compareTo(FunctionResource o)
    {
        return this.name.compareTo(o.name);
    }

    @Override
    public String toString()
    {
        switch (level)
        {
            case ROOT:
                return "<all functions>";
            case KEYSPACE:
                return String.format("<all functions in %s>", keyspace);
            case FUNCTION:
                return String.format("<function %s.%s(%s)>",

View on GitHub (pinned to 88fd0f6a0e)

Solutions

1. Exclude the system keyspaces (system, system_schema, etc.) from functions you grant permissions on
2. Skip or guard the GRANT/REVOKE statement when FunctionResource.getKeyspace() equals SchemaConstants.SYSTEM_KEYSPACE_NAME
3. If the goal was a user function, correct the keyspace qualifier in the statement

Example fix

// before
GRANT EXECUTE ON FUNCTION system.somefn(int) TO role1;
// after
GRANT EXECUTE ON FUNCTION myks.somefn(int) TO role1;

if (SchemaConstants.SYSTEM_KEYSPACE_NAME.equals(fnResource.getKeyspace()))
    throw new IllegalArgumentException("Cannot grant permissions on system-keyspace functions");

try { execute(grant); } catch (InvalidRequestException e) { /* skip system-keyspace functions */ }

When it happens

Trigger: Issuing GRANT/REVOKE/LIST PERMISSIONS ON FUNCTION system.<fn>(...) — e.g. attempting to grant EXECUTE on a function in the 'system' keyspace.

Common situations: Scripts that iterate all keyspaces including system ones and grant EXECUTE on every function; automations that mirror permissions across keyspaces without filtering system keyspaces.

Understand the failure class

Background: UnsupportedOperationException and "is not supported" errors: when a library deliberately refuses a call — this error's family across 30 libraries.

Related errors

• %s is not a valid data resource name
• In this context function name must be explictly qualified by
• %s is not a valid function resource name
• %s is not a valid function resource name. It must end with "
• %s function resource has no function name

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/1cb5ab54c219d882. Report an issue: GitHub.