When pending privileges are generated in grant management

The grant management function generates pending privileges when applicable, based on the defined group objects and group privileges, including any specified timestamps. Pending privileges include the required GRANT and REVOKE statements to implement the specified authorizations.

The following table lists the specific actions and conditions when GRANT and REVOKE statements are generated.

Table 1. When grant management generates GRANT and REVOKE statements
User action Statements that are generated Statements that are deleted Statements that are updated
Create a group object
If a group privilege for the object exists, statements are generated as follows:
  • GRANT statements are generated. However, if the group privilege has a specified start timestamp, those statements are not eligible to run until the specified timestamp.
  • REVOKE statements are generated if the group privilege has a specified end timestamp. Those statements are not eligible to run until the specified timestamp.
 None None
Create a group privilege without specified start and end timestamps If an applicable group object1 exists, GRANT statements are generated. None None
Create a group privilege with a specified end timestamp If an applicable group object1 exists, GRANT and REVOKE statements are generated. None None
Delete a group If a group object and an associated group privilege exist and the option to revoke privileges2 is selected, REVOKE statements are generated with a start date equal to the current timestamp. Any existing REVOKE statements are deleted. The group object is also deleted. The group name in the GRANT statement is removed. The group name is saved as Old Group Name on the GM - Manage Pending Privileges (ADB2ZGPP) panel and is used to select the statements to run.
Delete a privilege If an associated group privilege and applicable group object1 exist and the option to revoke privileges2 is selected, REVOKE statements are generated with a start date equal to the current timestamp. Any existing REVOKE statements are deleted. Associated group privileges are also deleted. The privilege name in the GRANT statement is removed, and the
Delete an SSID None None None
Delete a group object If the option to revoke privileges2 is selected, REVOKE statements are generated with a start date equal to the current timestamp. Any existing REVOKE statements are deleted. None
Delete a group privilege If an applicable group object1 exists and the option to revoke privileges2 is selected, REVOKE statements are generated. None None
Delete a privilege item from a privilege If an associated group privilege and applicable group object1 exist and the option to revoke privileges2 is selected, REVOKE statements are generated. None None
Add a privilege item to privilege If an associated group privilege and applicable group object1 exist, GRANT statements are generated. None None
Update a group privilege start timestamp None None The start date is updated in any existing pending GRANT statements.
Update a group privilege end timestamp If an applicable group object1 exists, REVOKE statements are generated. None Existing pending REVOKE statements are updated with the new timestamp.
Table notes:
  1. An applicable object means that the object type matches the privilege type for the privilege on which the group privilege was defined.
  2. The option to revoke privileges is specified on the delete confirmation panel for the object (option 1). When this option is selected, the ADMIN GM statement does not include the NOREVOKE option.