Informix Error -887

Reasons / Common Causes

-887 fires when REVOKE ... RESTRICT would leave other privileges, views, or table constraints abandoned — per the official guidance, RESTRICT specifically blocks a revoke that would orphan any of these three dependent object types.

1. Another user's privilege granted "with grant option" from the privilege being revoked, per the official guidance's "abandoned privileges" case — revoking the source privilege would leave the downstream grant without a valid basis.
2. A view depending on the privilege being revoked, per the official guidance's "abandoned views" case — the view's owner needed that privilege to create it.
3. A table constraint depending on the privilege being revoked, per the official guidance's "abandoned constraints" case — similarly, the constraint's existence relied on that privilege.

Solutions / Resolution

1. Identify the dependent privileges, views, or constraints before attempting the revoke — per the official guidance's pointer to the IBM Informix Guide to SQL: Tutorial for the full detail on how these dependencies work.
2. Revoke or drop the dependent objects first, then revoke the original privilege.
3. Or don't use RESTRICT (using the default/CASCADE behavior instead, if the server version supports it), if automatically cascading the revoke to dependents is actually intended — confirm the exact behavior for the server version in use before relying on it, since this is a more consequential operation.

Examples

Identifying what depends on a privilege before revoking

-- for a table/column privilege (the common case for -887):
SELECT grantor, grantee, tabauth FROM systabauth
WHERE tabid = (SELECT tabid FROM systables WHERE tabname = 'orders');
-- review the tabauth pattern for grant-option (upper-case) letters granted
-- downstream from the privilege about to be revoked; a procedure-execute
-- privilege instead uses sysprocauth (grantor, grantee, procid, procauth)
-- in the same way; check dependent views/constraints via sysviews/sysconstraints

Diagnostic Checks

1. Check for downstream privilege grants, dependent views, and dependent constraints that trace back to the privilege being revoked.

Related Errors / Related Topics

• -886 — "Cannot drop table or view because of existing dependencies." A related RESTRICT-option dependency check, for DROP TABLE/DROP VIEW rather than REVOKE.

RESTRICT blocks a revoke that would orphan downstream privileges, views, or constraints — identify and resolve those dependents first.