What causes "Cannot revoke privilege %s on table %s%s" in prestodb/presto?

Execute the REVOKE as a catalog admin

prestodb/presto · error · AccessDeniedException

Cannot revoke privilege %s on table %s%s

Error message

Cannot revoke privilege %s on table %s%s

What it means

Thrown when the identity lacks the REVOKE privilege needed to remove a privilege from another principal on a table. denyRevokeTablePrivilege is invoked from AccessControlManager.checkCanRevokeTablePrivilege. Only grantors/admins may revoke.

Source

Thrown at presto-spi/src/main/java/com/facebook/presto/spi/security/AccessDeniedException.java:332

    public static void denyGrantTablePrivilege(String privilege, String tableName)
    {
        denyGrantTablePrivilege(privilege, tableName, null);
    }

    public static void denyGrantTablePrivilege(String privilege, String tableName, String extraInfo)
    {
        throw new AccessDeniedException(format("Cannot grant privilege %s on table %s%s", privilege, tableName, formatExtraInfo(extraInfo)));
    }

    public static void denyRevokeTablePrivilege(String privilege, String tableName)
    {
        denyRevokeTablePrivilege(privilege, tableName, null);
    }

    public static void denyRevokeTablePrivilege(String privilege, String tableName, String extraInfo)
    {
        throw new AccessDeniedException(format("Cannot revoke privilege %s on table %s%s", privilege, tableName, formatExtraInfo(extraInfo)));
    }

    public static void denyShowRoles(String catalogName)
    {
        throw new AccessDeniedException(format("Cannot show roles from catalog %s", catalogName));
    }

    public static void denyShowCurrentRoles(String catalogName)
    {
        throw new AccessDeniedException(format("Cannot show current roles from catalog %s", catalogName));
    }

    public static void denyShowRoleGrants(String catalogName)
    {
        throw new AccessDeniedException(format("Cannot show role grants from catalog %s", catalogName));
    }

    public static void denySetSystemSessionProperty(String propertyName)

View on GitHub (pinned to 55bb57d202)

Solutions

Execute the REVOKE as a catalog admin
Adjust access control rules to allow the account to revoke
Grant the account admin-level table privilege management

Example fix

// before
REVOKE SELECT ON sales FROM USER carol; -- AccessDeniedException
// after (as admin)
-- admin executes:
REVOKE SELECT ON sales FROM USER carol;

Defensive patterns

Strategy: try-catch

Validate before calling

boolean canRevoke = catalogAdmin.isCatalogAdmin(revokingUser);

Try / catch

try {
    execute("REVOKE " + privilege + " ON " + table + " FROM USER " + grantee);
} catch (AccessDeniedException e) {
    throw new SecurityException("Offboarding revokes must run as a catalog admin", e);
}

Prevention

Run revocation/offboarding jobs with a dedicated admin principal
Pair every GRANT with a documented REVOKE owner
Test revoke flows in staging with the same identity used in production

When it happens

Trigger: REVOKE SELECT ON t FROM USER u where checkCanRevokeTablePrivilege denies the current identity; revoking a grant made by a different admin you don't control.

Common situations: Security offboarding where the revoking account isn't an admin; connectors restricting revoke to catalog owners; mismatches between grantor and revoker identities.

Related errors

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/918e8a9dde11b3c1. Report an issue: GitHub.