anchor.diff:      ;
       
   grantRolesToPrograms
  -    : roleName (COMMA roleName)* TO programUnit ( COMMA programUnit )*
  +    : roleNames TO programUnits
  +    ;
  +
  +programUnits
  +    : programUnit (COMMA programUnit)*
       ;
       
   programUnit
  
positive.code:     ;
      
  granteeIdentifiedBy
      : userName (COMMA userName)* IDENTIFIED BY STRING (COMMA STRING)*
      ;
      
  grantObjectPrivilegeClause
  
negative.code:     : objectPrivilege (COMMA objectPrivilege)* onObjectClause
      FROM grantees
      (CASCADE CONSTRAINTS | FORCE)?
      ;
      
  revokeRolesFromPrograms
      : (roleNames | ALL) FROM programUnits
      ;