REVOKE ROLE
Requires permissionRoles and access control →
Marked preset roles include the permission by default; a custom role qualifies when it inherits a role that includes it.
Use REVOKE ROLE to remove a role from a user or to remove inheritance between roles. See Roles and access control for the model.
Syntax​
REVOKE ROLE <role_name> FROM { USER <username> | ROLE <target_role> };
Parameters​
| Parameter | Description | Required |
|---|---|---|
<role_name> | The role being removed. | Yes |
USER <username> | Remove the role from a user. | One of USER or ROLE |
ROLE <target_role> | Remove inheritance so <target_role> no longer inherits <role_name>. | One of USER or ROLE |
Revoking a role removes only the access that role provided. If a user has the same access through another role, they keep it. Revoking a role from a user who does not hold it returns an error.
warning
If revoking a role leaves a user with no roles, that user becomes roleless and loses access to all data until someone with permission to assign roles assigns one. MotherDuck warns before completing the operation but does not block it.
Examples​
Remove a role from a user​
REVOKE ROLE finance FROM USER alice;