SQLCODE -551 — missing privilege

The authorization ID has no privilege for that operation on that object. The message names all three, so the fix is a precise grant, not a broad one.

What happened

A program, a batch job or a query got SQLCODE -551 (SQLSTATE 42501) and stopped.

Message (illustrative)Illustrative example

DSNT408I SQLCODE = -551, ERROR:  BRPT01 DOES NOT HAVE THE PRIVILEGE TO PERFORM
         OPERATION SELECT ON OBJECT DBADM1.BRANCH_FEE
DSNT418I SQLSTATE   = 42501 SQLSTATE RETURN CODE

What it means

Db2 checked the privileges of the authorization ID (and the groups it belongs to) and found none that allows the operation on the object. The message tells you who (the ID), what (the operation) and on which object.

Typical causes

A new table or view was created, and nobody granted access to the users or groups that read it.
The grant was made to the wrong group, or to a person instead of the job's ID.
The job now runs under a different user ID.
A privilege was revoked.

Where to look

The catalog: SYSIBM.SYSTABAUTH shows table privileges, with GRANTOR, GRANTEE and a column per privilege.
How similar objects are granted (for example the other tables the same report reads).
Which ID the job really runs under, and which groups it is in.

How to fix it

Grant the smallest privilege the job needs (often just SELECT) to the group your standards name.
Make the grant as someone allowed to: the owner (for example after SET CURRENT SQLID to the owning group) or a user with authority.
Avoid PUBLIC, ALL and WITH GRANT OPTION as quick fixes: they give far more than the job needs.

Interview question

A report fails with -551 on a table created yesterday. What do you do, and what do you avoid?