title: Sentry privileges model: Can Sentry take a database privileges away from a server privileges?
body: <p>Assume I have a user <code>jack</code> and a group <code>datateam</code>. The user <code>jack</code> belongs to group <code>datateam</code>.</p>
  
  <p>Use Sentry for authorization.</p>
  
  <pre><code>create role admin; 
  grant role admin to group datateam; 
  grant all on server server1 to role admin;
  </code></pre>
  
  <p>Now the role <code>admin</code> has the following priveleges.</p>
  
  <pre><code>+-----------+--------+------------+---------+-----------------+-----------------+------------+---------------+-------------------+----------+--+
  | database  | table  | partition  | column  | principal_name  | principal_type  | privilege  | grant_option  |    grant_time     | grantor  |
  +-----------+--------+------------+---------+-----------------+-----------------+------------+---------------+-------------------+----------+--+
  | *         |        |            |         | admin           | ROLE            | *          | false         | 1480985013185000  | --       |
  +-----------+--------+------------+---------+-----------------+-----------------+------------+---------------+-------------------+----------+--+
  </code></pre>
  
  <p>Assume I have this database.</p>
  
  <pre><code>create database testdb;
  </code></pre>
  
  <p>It is successful. User <code>jack</code> created a database <code>testdb</code>.</p>
  
  <p>Use Sentry to revoke the privileges on <code>testdb</code>;</p>
  
  <pre><code>revoke all on database `testdb` from role admin;
  </code></pre>
  
  <p>The priveleges is still the same.</p>
  
  <pre><code>+-----------+--------+------------+---------+-----------------+-----------------+------------+---------------+-------------------+----------+--+
  | database  | table  | partition  | column  | principal_name  | principal_type  | privilege  | grant_option  |    grant_time     | grantor  |
  +-----------+--------+------------+---------+-----------------+-----------------+------------+---------------+-------------------+----------+--+
  | *         |        |            |         | admin           | ROLE            | *          | false         | 1480985013185000  | --       |
  +-----------+--------+------------+---------+-----------------+-----------------+------------+---------------+-------------------+----------+--+
  </code></pre>
  
  <p>Shouldn't Sentry take the privileges on database <code>testdb</code> away from the server <code>server1</code>?</p>