Sentry privileges model: Can Sentry take a database privileges away from a server privileges?
<p>Assume I have a user <code>jack</code> and a group <code>datateam</code>. The user <code>jack</code> belongs to group <code>datateam</code>.</p>

<p>Use Sentry for authorization.</p>

<pre><code>create role admin; 
grant role admin to group datateam; 
grant all on server server1 to role admin;
</code></pre>

<p>Now the role <code>admin</code> has the following priveleges.</p>

<pre><code>+-----------+--------+------------+---------+-----------------+-----------------+------------+---------------+-------------------+----------+--+
| database  | table  | partition  | column  | principal_name  | principal_type  | privilege  | grant_option  |    grant_time     | grantor  |
+-----------+--------+------------+---------+-----------------+-----------------+------------+---------------+-------------------+----------+--+
| *         |        |            |         | admin           | ROLE            | *          | false         | 1480985013185000  | --       |
+-----------+--------+------------+---------+-----------------+-----------------+------------+---------------+-------------------+----------+--+
</code></pre>

<p>Assume I have this database.</p>

<pre><code>create database testdb;
</code></pre>

<p>It is successful. User <code>jack</code> created a database <code>testdb</code>.</p>

<p>Use Sentry to revoke the privileges on <code>testdb</code>;</p>

<pre><code>revoke all on database `testdb` from role admin;
</code></pre>

<p>The priveleges is still the same.</p>

<pre><code>+-----------+--------+------------+---------+-----------------+-----------------+------------+---------------+-------------------+----------+--+
| database  | table  | partition  | column  | principal_name  | principal_type  | privilege  | grant_option  |    grant_time     | grantor  |
+-----------+--------+------------+---------+-----------------+-----------------+------------+---------------+-------------------+----------+--+
| *         |        |            |         | admin           | ROLE            | *          | false         | 1480985013185000  | --       |
+-----------+--------+------------+---------+-----------------+-----------------+------------+---------------+-------------------+----------+--+
</code></pre>

<p>Shouldn't Sentry take the privileges on database <code>testdb</code> away from the server <code>server1</code>?</p>