What happens to the privileges granted to Snowflake system-defined roles?

Snowflake’s system-defined roles (e.g., ACCOUNTADMIN, SYSADMIN, SECURITYADMIN) are created with a specific set of privileges that are essential for their intended administrative functions. To ensure the stability and security of the account's management framework, these default privileges are immutable and cannot be revoked. While it is possible to grant additional privileges to these roles (though not recommended), the core set of privileges granted by the system cannot be taken away by any role, including ACCOUNTADMIN. This design prevents accidental lockouts or critical misconfigurations of the account's administrative structure.

B. The privileges can be revoked by an ACCOUNTADMIN. Even the ACCOUNTADMIN role, which has the highest level of authority within an account, is prohibited from revoking the default privileges assigned to system-defined roles.
C. The privileges can be revoked by an orgadmin. The ORGADMIN role operates at the organization level to manage accounts, but it does not have the authority to modify the internal privilege structure of system roles within an account.
D. The privileges can be revoked by any user-defined role with appropriate privileges. Snowflake's security model does not permit granting a user-defined (custom) role the ability to alter the fundamental privileges of system-defined roles. ---

1. Snowflake Documentation: System-Defined Roles.

Reference: Under the main description of system-defined roles

the documentation explicitly states: "The privileges granted to these roles cannot be revoked. In addition

Snowflake does not recommend granting additional privileges to these roles." This directly supports the correct answer.

2. Snowflake Documentation: Overview of Access Control.

Reference: This section describes the hierarchy and purpose of system-defined roles. It reinforces that these roles and their associated privileges form the foundation of Snowflake's role-based access control (RBAC) model

implying their core permissions are fixed for system integrity.