# 0LP01 — invalid_grant_operation

> PostgreSQL SQLSTATE 0LP01: invalid_grant_operation, source-backed diagnosis and recovery guidance.
---

# 0LP01

## At a glance {#at-a-glance}

SQLSTATE `0LP01` is **invalid_grant_operation** in Class `0L`. `0LP01` means that the GRANT or REVOKE operation is invalid for the object or privilege. The selected sequence case asks for `INSERT`, which is rejected with the dynamically assembled primary `invalid privilege type INSERT for sequence`; granting `USAGE` then succeeds.

<!-- BEGIN SQLSTATE FACTS: generated by scripts/generate.py; do not edit -->

| Field | Value |
| --- | --- |
| SQLSTATE | `0LP01` |
| Condition | `invalid_grant_operation` |
| Status | `active` |
| Known present by | `7.4` |
| Locked snapshots | `9.0.23, 9.1.24, 9.2.24, 9.3.25, 9.4.26, 9.5.25, 9.6.24, 10.23, 11.22, 12.22, 13.23, 14.24, 15.19, 16.15, 17.11, 18.6, 19beta3` |
| Macros | `ERRCODE_INVALID_GRANT_OPERATION` |
| Aliases | `—` |

<!-- source facts: data/errcodes/0LP01.json -->
<!-- END SQLSTATE FACTS -->

## Meaning {#meaning}

`0LP01` means that the GRANT or REVOKE operation is invalid for the object or privilege. The selected sequence case asks for `INSERT`, which is rejected with the dynamically assembled primary `invalid privilege type INSERT for sequence`; granting `USAGE` then succeeds.

## Diagnosis {#diagnosis}

Check object kind, privilege matrix, target role, ownership, and whether the statement is a column/default-privilege form. The selected error is an ERROR but leaves the autocommit session `IDLE`; the post-repair privilege check returns true.

## Response {#response}

Rewrite the statement for the object’s supported privileges and verify the resulting ACL. For a sequence, choose the intended `USAGE`, `SELECT`, or `UPDATE` privilege; do not grant a broader privilege or retry unchanged.

## Observed diagnostics {#messages}

The structured evidence preserves the message template or dynamic assembly boundary. For this page, do not treat a client exception without a server diagnostic as proof of `0LP01`.

## Representative case {#case}

<!-- BEGIN SQLSTATE SNIPPET: invalid_grant_operation -->

The SQL block creates a sequence, attempts the invalid `INSERT` privilege, grants `USAGE`, and verifies the effective privilege for the disposable role.

```sql
CREATE SEQUENCE grant_sequence;
GRANT INSERT ON SEQUENCE grant_sequence TO role;
GRANT USAGE ON SEQUENCE grant_sequence TO role;
SELECT has_sequence_privilege(role_literal, 'grant_sequence', 'USAGE');
```

<!-- END SQLSTATE SNIPPET -->

The selected 18.6 run reports SQLSTATE `0LP01`, primary `invalid privilege type INSERT for sequence`, and the asserted recovery state is `IDLE` before the final probe/repair. Every assertion and cleanup passed on 18.6 and 10.21.

The downloadable case and evidence projections are [`0LP01 case JSON`](../data/cases/0lp01.json) and [`authored evidence`](../data/evidence/0lp01.json). The runner manifest is `verify/cases/0LP01/cases.json`; the page SQL is checked against its shared registry before publication.

## Versions {#versions}

The generated facts table records the locked catalogue snapshots and earliest observed definition. The selected natural runtime scope is PostgreSQL 18.6 and 10.21; this does not infer behavior for every intermediate release.

## Related {#related}

- [`0L000` — invalid_grantor](../0l000/)
- [`42501` — related condition](../42501/)

## Sources {#sources}

- `src.acl-invalid-grant-dynamic.18.6` — `src/backend/catalog/aclchk.c` at `REL_18_6` commit `724edf9bde9d356724ad384a2e196edc3c9f80f7`; fixed blob SHA-256 `9700258318959b47c42edb423418fb511dd3a008023e732f601eecf4c80868f8` ([source](https://github.com/postgres/postgres/blob/724edf9bde9d356724ad384a2e196edc3c9f80f7/src/backend/catalog/aclchk.c#L585-L587)).
- `src.acl-invalid-grant-dynamic.10.23` — `src/backend/catalog/aclchk.c` at `REL_10_23` commit `02991e79f8f58bc208f05dcc8af0c62dbe0a6ea4`; fixed blob SHA-256 `3a4330bd55ea8c0ec12324d7046ec31d64c920f99196235b84612d6cd1a4b26c` ([source](https://github.com/postgres/postgres/blob/02991e79f8f58bc208f05dcc8af0c62dbe0a6ea4/src/backend/catalog/aclchk.c#L548-L550)).
- `src.calls.REL_18_6` / `src.calls.REL_10_23` — fixed local call scans, SHA-256 `9ee8a0e81d8f0825c5c1ae45583439859a26e602bdd4ce2f2a62aa278867ccbf` / `00d16d3eb01b71ccf1b245c8f3102f9d0ec9f36fb02777b8dd1b99fcb263040c`; these scans preserve the resolved call context used by the claims.