prestodb/presto · error · AccessDeniedException

ACCESS_DENIED

ACCESS_DENIED

Error message

Query integrity check failed.

What it means

AccessDeniedException.denyQueryIntegrityCheck is a helper used by system access control implementations to reject query-integrity verification requests. Systems access controls call this when the configured authorizer does not support or refuses to attest to query integrity checks (e.g. can't guarantee the query hasn't been tampered with between validation and execution).

Source

Thrown at presto-spi/src/main/java/com/facebook/presto/spi/security/AccessDeniedException.java:42

import static com.facebook.presto.spi.StandardErrorCode.PERMISSION_DENIED;
import static java.lang.String.format;

public class AccessDeniedException
        extends PrestoException
{
    public AccessDeniedException(String message)
    {
        super(PERMISSION_DENIED, "Access Denied: " + message);
    }

    public static void denySetUser(Optional<Principal> principal, String userName)
    {
        denySetUser(principal, userName, null);
    }

    public static void denyQueryIntegrityCheck()
    {
        throw new AccessDeniedException("Query integrity check failed.");
    }

    public static void denySetUser(Optional<Principal> principal, String userName, String extraInfo)
    {
        throw new AccessDeniedException(format("Principal %s cannot become user %s%s", principal.orElse(null), userName, formatExtraInfo(extraInfo)));
    }

    public static void denyCatalogAccess(String catalogName)
    {
        denyCatalogAccess(catalogName, null);
    }

    public static void denyCatalogAccess(String catalogName, String extraInfo)
    {
        throw new AccessDeniedException(format("Cannot access catalog %s%s", catalogName, formatExtraInfo(extraInfo)));
    }

    public static void denyCreateSchema(String schemaName)

View on GitHub (pinned to 55bb57d202)

Solutions

1. Implement/upgrade the SystemAccessControl plugin to support query integrity checks
2. Switch to an access control implementation that supports integrity verification
3. Disable the feature that requires integrity checks if your security model permits it
4. Check the access control plugin version against the engine version's requirements

Example fix

// before
@Override
public void checkQueryIntegrity(...) {
    denyQueryIntegrityCheck();
}
// after
@Override
public void checkQueryIntegrity(...) {
    if (!supportsIntegrityChecks) {
        denyQueryIntegrityCheck(); // make this opt-in/configurable
    }
    verifyQueryHash(...);
}

// Before enabling integrity-dependent features, confirm the authorizer supports it
boolean supported = systemAccessControl instanceof QueryIntegrityCapable;
if (!supported) {
    LOG.warn("Configured access control does not support query integrity checks");
}

try {
    query.submit();
} catch (AccessDeniedException e) {
    if (e.getMessage().contains("Query integrity check failed")) {
        // upgrade/replace the SystemAccessControl plugin or disable the integrity-gated feature
    }
    throw e;
}

When it happens

Trigger: A SystemAccessControl implementation calls denyQueryIntegrityCheck() because checkQueryIntegrity / integrity attestation is not supported by the configured security policy.

Common situations: Clusters configured with a custom or legacy access control plugin lacking integrity-check support; enabling features that require query integrity verification while using a basic file-based or read-only authorizer; security policy upgrades introducing integrity requirements the plugin predates.

Related errors

• Cannot update columns [%s] in table %s%s
• Cannot create view %s%s
• Cannot set role %s
• Unsupported privilege name:
• User [%s] not a member of the authorized group

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/017fe9fb5e1d4749. Report an issue: GitHub.