Cirro privileges are executed in a specific order.

Privilege statement execution

You can GRANT, DENY or REVOKE privileges only when you have:

  • that permission on the securable, or

  • one or more permissions with higher level scope on the securable, or

  • ownership of the securable.

Privilege Precedence

Privilege precedence works by:

  • Denying access if an explicit DENY is present on the principal and securable.

  • Allowing access if an explicit GRANT is present on the principal and securable.

  • Denying access in all other circumstances.

See Also