SQLSTATE / CLASS 0L · INVALID GRANTOR

0LP01

invalid_grant_operation

SQLSTATE: 0LP01
Condition name: invalid_grant_operation
Class: Invalid Grantor
Source macro: ERRCODE_INVALID_GRANT_OPERATION
Evidence: Observed at runtime in the source evidence

Analysis & operational context

English SQLSTATE atlas: authored explanations and source/runtime evidence are separate from the manual definitions. View source ↗

At a glance

SQLSTATE 0LP01 is invalid_grant_operation in Class 0L. 0LP01 means that the GRANT or REVOKE operation is invalid for the object or privilege. The selected sequence case asks for INSERT, which is rejected with the dynamically assembled primary invalid privilege type INSERT for sequence; granting USAGE then succeeds.

Meaning

0LP01 means that the GRANT or REVOKE operation is invalid for the object or privilege. The selected sequence case asks for INSERT, which is rejected with the dynamically assembled primary invalid privilege type INSERT for sequence; granting USAGE then succeeds.

Diagnosis

Check object kind, privilege matrix, target role, ownership, and whether the statement is a column/default-privilege form. The selected error is an ERROR but leaves the autocommit session IDLE; the post-repair privilege check returns true.

Response

Rewrite the statement for the object’s supported privileges and verify the resulting ACL. For a sequence, choose the intended USAGE, SELECT, or UPDATE privilege; do not grant a broader privilege or retry unchanged.

Observed diagnostics

The structured evidence preserves the message template or dynamic assembly boundary. For this page, do not treat a client exception without a server diagnostic as proof of 0LP01.

Representative case

The SQL block creates a sequence, attempts the invalid INSERT privilege, grants USAGE, and verifies the effective privilege for the disposable role.

CREATE SEQUENCE grant_sequence;
GRANT INSERT ON SEQUENCE grant_sequence TO role;
GRANT USAGE ON SEQUENCE grant_sequence TO role;
SELECT has_sequence_privilege(role_literal, 'grant_sequence', 'USAGE');

The selected 18.6 run reports SQLSTATE 0LP01, primary invalid privilege type INSERT for sequence, and the asserted recovery state is IDLE before the final probe/repair. Every assertion and cleanup passed on 18.6 and 10.21.

The downloadable case and evidence projections are 0LP01 case JSON and authored evidence. The runner manifest is verify/cases/0LP01/cases.json; the page SQL is checked against its shared registry before publication.

Versions

The generated facts table records the locked catalogue snapshots and earliest observed definition. The selected natural runtime scope is PostgreSQL 18.6 and 10.21; this does not infer behavior for every intermediate release.

Sources

src.acl-invalid-grant-dynamic.18.6 — src/backend/catalog/aclchk.c at REL_18_6 commit 724edf9bde9d356724ad384a2e196edc3c9f80f7; fixed blob SHA-256 9700258318959b47c42edb423418fb511dd3a008023e732f601eecf4c80868f8 (source).
src.acl-invalid-grant-dynamic.10.23 — src/backend/catalog/aclchk.c at REL_10_23 commit 02991e79f8f58bc208f05dcc8af0c62dbe0a6ea4; fixed blob SHA-256 3a4330bd55ea8c0ec12324d7046ec31d64c920f99196235b84612d6cd1a4b26c (source).
src.calls.REL_18_6 / src.calls.REL_10_23 — fixed local call scans, SHA-256 9ee8a0e81d8f0825c5c1ae45583439859a26e602bdd4ce2f2a62aa278867ccbf / 00d16d3eb01b71ccf1b245c8f3102f9d0ec9f36fb02777b8dd1b99fcb263040c; these scans preserve the resolved call context used by the claims.

Source evidence

Evidence belongs to the frozen source and runtime versions listed here. It is not a runtime verification of the selected manual version.

0LP01 is the invalid_grant_operation condition in Class 0L.

Method: Read the fixed errcodes.txt definition and the locked catalogue metadata.

Limits: Directory identity does not identify every backend or client path.

src.errcodes.18.6

The fixed source paths associated with 0LP01 report the condition in the mechanism selected for this page.

Method: Trace the resolved source call records at the fixed release commits and compare their dynamic message fields.

Limits: Other calls can retain the same SQLSTATE with different context or text.

src.acl-invalid-grant-dynamic.18.6 src.acl-invalid-grant-dynamic.10.23

The selected invalid_grant_operation case passed with the expected structured diagnostics, recovery assertions, and cleanup on PostgreSQL 18.6 and 10.21.

Method: Run the shared registry case on isolated runner-owned latest and PG10 targets; inspect the final summaries and raw results.

Limits: This covers the selected case and versions only; it does not generalize to every driver, proxy, or intermediate release.

snippet-registry.0LP01 manifest.0LP01

The locked catalogue records 0LP01 in the listed snapshots; the runtime comparison here is limited to PostgreSQL 18.6 and 10.21.

Method: Read the generated facts block and locked manifest, then compare the selected target summaries.

Limits: Presence in a definition file is not an exact behavioral introduction; the two runtime targets do not prove all middle versions.

src.errcodes.18.6 src.calls.REL_18_6 src.calls.REL_10_23

src/backend/utils/errcodes.txt · REL_18_6 ·
724edf9bde9d356724ad384a2e196edc3c9f80f7
raw/calls/REL_18_6.jsonl · REL_18_6 ·
raw/calls/REL_10_23.jsonl · REL_10_23 ·
src/backend/catalog/aclchk.c · REL_18_6 ·
724edf9bde9d356724ad384a2e196edc3c9f80f7
src/backend/catalog/aclchk.c · REL_10_23 ·
02991e79f8f58bc208f05dcc8af0c62dbe0a6ea4
verify/cases/0LP01/cases.json · workspace ·
verify/cases/0LP01/snippets.json · workspace ·

Message templates

explicit ERROR · message.invalid-grant-dynamic

Primary

invalid privilege type INSERT for sequence

The primary is dynamically assembled from the object and privilege; the example is an observed instantiation, not a static format string.

Reproduction & repair cases

invalid_grant_operation · PG 10, 18

Preconditions

A runner-owned disposable target is provisioned.

Trigger: Grant an invalid sequence privilege, then grant USAGE to a disposable role.

Expected assertions

The selected server diagnostic has the expected SQLSTATE
The selected recovery/probe assertions pass
Runner-owned resources are cleaned up

Repair: Follow the case-specific repair statements and verify the resulting state.

Cleanup: Drop the case schema with an owner connection.

Recorded runtime evidence

18.6 (Homebrew) · passed

Run: 0LP01-conn-test-latest

Disposable runner-owned target only; this is a bounded mechanism case, not a guarantee for every client or network path.

{
  "role": "u0lp01_4a1b230fc0",
  "statuses": {
    "final": "IDLE",
    "after_error": "IDLE"
  },
  "diagnostic": {
    "text": "invalid privilege type INSERT for sequence",
    "context": null,
    "severity": "ERROR",
    "sqlstate": "0LP01",
    "table_name": null,
    "column_name": null,
    "schema_name": null,
    "source_file": "aclchk.c",
    "source_line": "587",
    "message_hint": null,
    "datatype_name": null,
    "exception_type": "InvalidGrantOperation",
    "internal_query": null,
    "message_detail": null,
    "constraint_name": null,
    "message_primary": "invalid privilege type INSERT for sequence",
    "source_function": "ExecuteGrantStmt",
    "internal_position": null,
    "statement_position": null,
    "severity_nonlocalized": "ERROR"
  },
  "valid_privilege": "USAGE",
  "connection_autocommit": true
}

10.21 (Debian 10.21-1.pgdg90+1) · passed

Run: 0LP01-conn-test-pg10