What happens when a user is granted a permission and then denied the same permission in a warehouse?

What happens when a user is granted a permission and then denied the same permission in a warehouse?

• A. The GRANT statement supersedes the DENY, and the user will have access.
• B. The user has both permissions, and it causes a conflict.
• C. The resulting state is undefined without a role reassignment.
• D. The DENY always supersedes the GRANT, and the user is denied access.

Answer: (D)

Explicit denial overrides an allowed permission. If a user is granted a permission and then denied the same permission, the denial takes precedence and access is blocked. This prevents bypassing a deny with a prior grant and keeps security rules predictable. So the final outcome is denial. The other ideas—grant winning, a conflicting state from having both, or an undefined outcome—don’t match how access control rules are enforced.

Explicit denial overrides an allowed permission. If a user is granted a permission and then denied the same permission, the denial takes precedence and access is blocked. This prevents bypassing a deny with a prior grant and keeps security rules predictable. So the final outcome is denial. The other ideas—grant winning, a conflicting state from having both, or an undefined outcome—don’t match how access control rules are enforced.