Naming a subject in SQL
GRANT and REVOKE accept a role, user, or group name directly, with an
optional keyword to disambiguate:
USER or GROUP name is resolved against your identity provider, but
only after the caller’s OWNERSHIP on the object is checked. A name that
isn’t found, or that matches more than one identity, is an error — not a
silent no-op. ROLE needs no such lookup, since a role is simply whatever
name a grant has used.
Name several subjects of the same kind in one statement by omitting the
keyword after the first:
Role membership in SQL
SQL manages which users or groups a role applies to — its membership — directly:GRANT/REVOKE ROLE) needs system OPERATE;
SHOW ROLE BINDINGS needs only system USAGE. A role binding accepts a
USER or GROUP on the receiving side, never another ROLE — granting
a privilege to a role before anyone is a member of it is still valid; the
role simply has no effect until it has members.
What to read next
Authorization
The access-control model a grant is built from.
Privileges
Every object’s privileges, and the GRANT/REVOKE syntax that covers them.