anchor.diff:      ;
   
   objectPrivilege
  -    : ID *?
  -    | ALL PRIVILEGES?
  +    : ID *? | ALL PRIVILEGES?
       ;
   
   onObjectClause
  
positive.code:     ;
  
  grantee
      : userName 
      | roleName 
      | PUBLIC 
      ;
  
  granteeIdentifiedBy
  
negative.code: alterUser
      : ALTER USER
      ( 
          userName
          ( 
              IDENTIFIED (BY STRING (REPLACE STRING)? | (EXTERNALLY | GLOBALLY) ( AS STRING)?)
              | DEFAULT TABLESPACE ID
              | TEMPORARY TABLESPACE ID
              | QUOTA (sizeClause | UNLIMITED) ON ID
              | PROFILE ID
              | PASSWORD EXPIRE
              | ACCOUNT (LOCK | UNLOCK)
              | ENABLE EDITIONS (FOR ids)? FORCE?
              | CONTAINER EQ_ (CURRENT | ALL)
              | DEFAULT ROLE (roleNames| ALL (EXCEPT roleNames)?| NONE)
              | ID
          )*
          | userNames proxyClause
      ) 
      ;
  
  containerDataClause
      : (
            SET CONTAINER_DATA EQ_ ( ALL | DEFAULT | idList )
            | (ADD |REMOVE) CONTAINER_DATA EQ_ idList
      )
      (FOR schemaName? ID)?
      ;
  