# 01007 — privilege_not_granted

> PostgreSQL SQLSTATE 01007 is emitted as a WARNING when a GRANT operation grants none or not all of the requested privileges.
---

# 01007 — privilege_not_granted

## At a glance {#at-a-glance}

`01007` has confirmed PostgreSQL 18.6 `WARNING` paths in `src/backend/catalog/aclchk.c` for `GRANT`. It reports an empty or partial grant and does not by itself mean the GRANT statement failed as an error.

<!-- BEGIN SQLSTATE FACTS: generated by scripts/generate.py; do not edit -->

| Field | Value |
| --- | --- |
| SQLSTATE | `01007` |
| Condition | `privilege_not_granted` |
| Status | `active` |
| Known present by | `8.0.0` |
| Locked snapshots | `9.0.23, 9.1.24, 9.2.24, 9.3.25, 9.4.26, 9.5.25, 9.6.24, 10.23, 11.22, 12.22, 13.23, 14.24, 15.19, 16.15, 17.11, 18.6, 19beta3` |
| Macros | `ERRCODE_WARNING_PRIVILEGE_NOT_GRANTED` |
| Aliases | `—` |

<!-- source facts: data/errcodes/01007.json -->
<!-- END SQLSTATE FACTS -->

## Meaning {#meaning}

The confirmed 18.6 implementation is the ACL command path for GRANT. It distinguishes no privilege granted from not all privileges granted and uses column-specific and object-specific templates.

## Messages and diagnostics {#messages}

The fixed 18.6 paths use `no privileges were granted for column "%s" of relation "%s"`, `no privileges were granted for "%s"`, `not all privileges were granted for column "%s" of relation "%s"`, and `not all privileges were granted for "%s"`. The resolved groups have no detail or hint.

## Diagnosis {#diagnosis}

Record whether the target was a column or object and the exact relation/object name. In the fixed `aclchk.c` function, `this_privileges` is the requested set intersected with the effective grantor's available grant options. The `GRANT` warning is `none` when that mask is zero, and `partial` when `!all_privs` and the mask differs from the request; this warning branch does not inspect the grantee's old ACL. Inspect the effective grantor, grant options, requested privileges, and then the resulting ACL separately. Distinguish the partial `WARNING` from an error-category permission failure.

## Response {#response}

Check the resulting ACL and correct the role, target, privilege, or grant option identified by the operation. Reissuing unchanged GRANT is useful only after the privilege mismatch has been understood.

## Versions {#versions}

`01007` is present from the locked 9.0.23 snapshot through 18.6 and 19 Beta 3, with `known_present_by` 8.0.0. The fixed 18.6 paths establish current source wording and severity, not identical historical text.

## Related {#related}

[`01006`](../01006/) is the privilege-not-revoked warning; [`42501`](../42501/) is a permission error; [`01000`](../01000/) is the warning class.

## Sources {#sources}

- [`errcodes.txt`](https://github.com/postgres/postgres/blob/724edf9bde9d356724ad384a2e196edc3c9f80f7/src/backend/utils/errcodes.txt#L88) — definition, SHA-256 `6e8de346643ba84aa3c9c6a73360acfc7b2dfb89162c06c08ce9bf5bcd5bbcba`.
- [`aclchk.c`](https://github.com/postgres/postgres/blob/724edf9bde9d356724ad384a2e196edc3c9f80f7/src/backend/catalog/aclchk.c#L318-L382) — fixed path, SHA-256 `9700258318959b47c42edb423418fb511dd3a008023e732f601eecf4c80868f8`.
- [Structured evidence](../data/evidence/01007.json) — fixed sources, message groups, and runtime boundary.