REVOKE ROLE system-role  
FROM grantee, ...

grantee : 
{ system-role | userid }

system-role : 
dbo
| DIAGNOSTICS
| PUBLIC
| rs_systabgroup
| SA_DEBUG
| SYS
| SYS_REPLICATION_ADMIN_ROLE
| SYS_RUN_REPLICATION_ROLE
| SYS_SAMONITOR_ROLE
| SYS_SPATIAL_ADMIN_ROLE

REVOKE [ ADMIN OPTION FOR ] ROLE user-defined-role  
FROM grantee, ...

grantee : 
{ system-role | userid }

REVOKE [ ADMIN OPTION FOR ] ROLE compatibility-role-name  
FROM grantee, ...

compatibility-role-name : 
SYS_AUTH_BACKUP_ROLE
| SYS_AUTH_DBA_ROLE
| SYS_AUTH_PROFILE_ROLE
| SYS_AUTH_READCLIENTFILE_ROLE
| SYS_AUTH_READFILE_ROLE
| SYS_AUTH_RESOURCE_ROLE
| SYS_AUTH_SA_ROLE
| SYS_AUTH_SSO_ROLE
| SYS_AUTH_VALIDATE_ROLE
| SYS_AUTH_WRITECLIENTFILE_ROLE
| SYS_AUTH_WRITEFILE_ROLE

grantee : 
{ system-role | userid }

REVOKE [ ADMIN OPTION FOR ] privilege 
FROM grantee, ...

grantee : 
{ system-role | userid }

REVOKE object-level-privilege[,...]
ON [ owner.]table-or-view
FROM userid[,...]

object-level-privilege : 
ALL [ PRIVILEGES ] 
| ALTER 
| DELETE 
| INSERT 
| LOAD 
| REFERENCES [ ( column-name[,...] ) ] 
| SELECT [ ( column-name[,...] ) ] 
| TRUNCATE 
| UPDATE [ ( column-name[,...] ) ]

REVOKE capability FROM userid[,...]

capability : 
CONNECT
| INTEGRATED LOGIN
| KERBEROS LOGIN

REVOKE EXECUTE
ON [ owner.]procedure-name[,...]
FROM userid[,...]

REVOKE USAGE ON SEQUENCE sequence-name[,...]
FROM userid[,...]

If a role or privilege that is being revoked was not granted to grantee, then the statement does nothing, and does not return an error.

REVOKE ROLE fails with an error if, as a consequence of executing the statement, the number of administrators for the role or privileges being revoked would fall below the required minimum as set by the min_role_admins database option.

When you revoke object-level privileges from a role, grantees of that role inherit those changes.

When you revoke an object-level privilege for a user who also had administrative rights for that privilege, then everyone who that user granted the privilege to also has their privilege revoked, as well as anyone that the grantees granted it to, and so on.

If you are revoking connection-related privileges from a user, the user must not be connected to the database.

You must have administration rights for the system privileges or roles that you are revoking.

If you are revoking object-level privileges, you must have one of the following:

Automatic commit.

• Viewing the roles and privileges for a user or role (Sybase Central)
• System privileges
• Object-level privileges
• Roles
• Authorities become compatibility roles
• min_role_admins option
• GRANT statement

This example prevents user Dave from updating the Employees table.

REVOKE UPDATE ON GROUPO.Employees FROM Dave;

This example revokes the SYS_AUTH_VALIDATE_ROLE compatibility role from fictitious user Jim.

REVOKE ROLE SYS_AUTH_VALIDATE_ROLE FROM Jim;

This example revokes the DIAGNOSTICS system role from a fictitious user named Administrator.

REVOKE ROLE DIAGNOSTICS FROM Administrator;

This example prevents a fictitious user-extended role called Finance from executing the procedure ShowCustomers.

REVOKE EXECUTE ON ShowCustomers FROM Finance;

This example drops user FranW from the database. This syntax is deprecated; consider using the DROP USER statement instead.

REVOKE CONNECT FROM FranW;

This example revokes database login privilege from a fictitious Kerberos user, pchin.

REVOKE KERBEROS LOGIN
FROM "pchin@MYREALM.COM";