anchor.diff:  #include "cql3/statements/alter_user_statement.hh"
   #include "cql3/statements/drop_user_statement.hh"
   #include "cql3/statements/list_users_statement.hh"
  +#include "cql3/statements/grant_statement.hh"
  +#include "cql3/statements/revoke_statement.hh"
  +#include "cql3/statements/list_permissions_statement.hh"
   #include "cql3/statements/index_target.hh"
   #include "cql3/statements/ks_prop_defs.hh"
   #include "cql3/selection/raw_selector.hh"
  
positive.code:     | st14=alterTableStatement         { $stmt = st14; }
  #if 0
      | st15=alterKeyspaceStatement      { $stmt = st15; }
      | st16=grantStatement              { $stmt = st16; }
      | st17=revokeStatement             { $stmt = st17; }
      | st18=listPermissionsStatement    { $stmt = st18; }
  #endif
      | st19=createUserStatement         { $stmt = st19; }
      | st20=alterUserStatement          { $stmt = st20; }
      | st21=dropUserStatement           { $stmt = st21; }
  
negative.code:     : K_TRUNCATE (K_COLUMNFAMILY)? cf=columnFamilyName { $stmt = ::make_shared<truncate_statement>(cf); }
      ;
  
  /**
   * GRANT <permission> ON <resource> TO <username>
   */
  grantStatement returns [::shared_ptr<grant_statement> stmt]
      : K_GRANT
            permissionOrAll
        K_ON
            resource
        K_TO
            username
        { $stmt = ::make_shared<grant_statement>($permissionOrAll.perms, $resource.res, $username.text); } 
      ;
  
  /**
   * REVOKE <permission> ON <resource> FROM <username>
   */
  revokeStatement returns [::shared_ptr<revoke_statement> stmt]
      : K_REVOKE
            permissionOrAll
        K_ON
            resource
        K_FROM
            username
        { $stmt = ::make_shared<revoke_statement>($permissionOrAll.perms, $resource.res, $username.text); } 
      ;
  
  listPermissionsStatement returns [::shared_ptr<list_permissions_statement> stmt]
      @init {
  		std::experimental::optional<auth::data_resource> r;
  		std::experimental::optional<sstring> u;
  		bool recursive = true;
      }
      : K_LIST
            permissionOrAll
        ( K_ON resource { r = $resource.res; } )?
        ( K_OF username { u = sstring($username.text); } )?
        ( K_NORECURSIVE { recursive = false; } )?
        { $stmt = ::make_shared<list_permissions_statement>($permissionOrAll.perms, std::move(r), std::move(u), recursive); } 
      ;
  
  permission returns [auth::permission perm]
      : p=(K_CREATE | K_ALTER | K_DROP | K_SELECT | K_MODIFY | K_AUTHORIZE)
      { $perm = auth::permissions::from_string($p.text); }
      ;
  
  permissionOrAll returns [auth::permission_set perms]
      : K_ALL ( K_PERMISSIONS )?       { $perms = auth::permissions::ALL_DATA; }
      | p=permission ( K_PERMISSION )? { $perms = auth::permission_set::from_mask(auth::permission_set::mask_for($p.perm)); }
      ;
  
  resource returns [auth::data_resource res]
      : r=dataResource { $res = $r.res; }
      ;
  
  dataResource returns [auth::data_resource res]
      : K_ALL K_KEYSPACES { $res = auth::data_resource(); }
      | K_KEYSPACE ks = keyspaceName { $res = auth::data_resource($ks.id); }
      | ( K_COLUMNFAMILY )? cf = columnFamilyName
        { $res = auth::data_resource($cf.name->get_keyspace(), $cf.name->get_column_family()); }
      ;
  
  /**
   * CREATE USER [IF NOT EXISTS] <username> [WITH PASSWORD <password>] [SUPERUSER|NOSUPERUSER]
  