DF077: The GRANT/REVOKE/DENY statement is used within the body of a stored procedure.

Last modified: July 9, 2025

The topic describes the DF077 T-SQL code analysis rule.

Category

BEST PRACTICE

Message

The GRANT/REVOKE/DENY statement is used within the body of a stored procedure.

Description

Avoid altering security within stored procedures or triggers. Modifying security settings dynamically can lead to inconsistent permissions, potential security risks, and make auditing and troubleshooting more difficult.

Additional information

Embedding GRANT, REVOKE, or DENY in procedural code can obscure the security model, make permission issues harder to diagnose, and increase the risk of unintended privilege escalation or denial. Managing permissions outside of procedural logic ensures a clearer, more predictable security configuration.

Noncompliant code example

CREATE OR ALTER PROCEDURE dbo.DemoProcedure
AS BEGIN
    GRANT EXECUTE ON dbo.SomeOtherProcedure TO public;
END
GO