What happens when a user is granted a permission and then denied the same permission in a warehouse?

What happens when a user is granted a permission and then denied the same permission in a warehouse?

• A. The GRANT statement supersedes the DENY, and the user will have access to the specific object.
• B. The DENY always supersedes the GRANT, and the user is denied access to the specific object.
• C. The user has both permissions, and it causes a conflict.
• D. Permissions are merged without precedence rules.

Answer: (B)

Explicit denial takes precedence over any prior grant. When a user is granted access to something and a subsequent denial to the same permission is in effect, the denial blocks the access. This design ensures security: a restriction can override an earlier allowance to prevent unintended access, even if an earlier grant existed. It isn’t treated as a conflict or a simple merge; the denial wins because access control policies are built to favor restrictions to protect resources. For a warehouse, this means the user cannot access the object once a denial is active, despite the previous grant.

Explicit denial takes precedence over any prior grant. When a user is granted access to something and a subsequent denial to the same permission is in effect, the denial blocks the access. This design ensures security: a restriction can override an earlier allowance to prevent unintended access, even if an earlier grant existed. It isn’t treated as a conflict or a simple merge; the denial wins because access control policies are built to favor restrictions to protect resources. For a warehouse, this means the user cannot access the object once a denial is active, despite the previous grant.