Which privilege must be granted by one role to another role, and cannot be revoked?

The OWNERSHIP privilege confers full control over an object. In Snowflake, this privilege is not granted in the same way as others; it is transferred from one role to another using the GRANT OWNERSHIP command. Once ownership is transferred, the original owning role loses the privilege. This action is final and cannot be undone with a REVOKE command. To return ownership, the new owner must execute another GRANT OWNERSHIP command back to the original role. The Snowflake documentation explicitly states that the OWNERSHIP privilege cannot be revoked.

A. MONITOR: The MONITOR privilege, which allows viewing object details, can be granted to and revoked from roles using standard GRANT and REVOKE commands.
B. OPERATE: The OPERATE privilege, which allows using an object like a warehouse, can be granted to and revoked from roles using standard GRANT and REVOKE commands.
D. ALL: ALL is a shorthand for granting all applicable privileges on an object. These privileges can be granted and subsequently revoked, either individually or as a group.

1. Snowflake Documentation: GRANT OWNERSHIP.

Section/Reference: In the "Usage Notes" section, it explicitly states: "The OWNERSHIP privilege cannot be revoked. To transfer ownership of an object, a user must execute the GRANT OWNERSHIP command." This directly confirms that OWNERSHIP is the correct answer.

2. Snowflake Documentation: Overview of Access Control.

Section/Reference: Under the "Ownership of Database Objects" subsection, the documentation describes how ownership can be transferred using GRANT OWNERSHIP, distinguishing it from other privileges that are simply granted or revoked.

3. Snowflake Documentation: REVOKE \.

Section/Reference: The documentation for the REVOKE command lists the various privileges that can be revoked (e.g., SELECT, USAGE, OPERATE, MONITOR). OWNERSHIP is conspicuously absent from this list, reinforcing that it is not a revocable privilege.