GRANT privilege_types ON securable_object TO principal
 
privilege_types
  { ALL PRIVILEGES |
    privilege_type [, ...] }

REVOKE privilege_types ON securable_object FROM principal
 
privilege_types
  { ALL PRIVILEGES |
    privilege_type [, ...] }

principal need to be user which connect through sql endpoint (from BI tool for example)