anchor.diff:      ;
   
   systemObject
  -    : ALL PRIVILEGES
  -    | roleName
  -    | ID *?
  +    : ALL PRIVILEGES | roleName | ID *?
       ;
   
   grantees
  
positive.code:         NOT IDENTIFIED
          | IDENTIFIED (BY STRING| USING schemaName? ID| EXTERNALLY | GLOBALLY)
      )? 
      ( CONTAINER EQ_ ( CURRENT | ALL ) )? 
      ;
  
  alterRole
      : ALTER ROLE roleName
      ( 
            NOT IDENTIFIED
          | IDENTIFIED (BY STRING| USING schemaName? ID| EXTERNALLY | GLOBALLY)
      )
      (CONTAINER EQ_ ( CURRENT | ALL ))? 
      ;
  
  dropRole
  
negative.code:     ;
  
  grantee
      : userName  | roleName | PUBLIC 
      ;
  
  granteeIdentifiedBy
  