add grant/revoke privileges api