From 68c2d2e6afc1c0ace103cd1e02e7df7b430f9f4d Mon Sep 17 00:00:00 2001
From: Russell Spitzer <Russell.Spitzer@gmail.com>
Date: Fri, 3 Feb 2017 10:35:37 -0800
Subject: [PATCH] Document Un-revokable Select on System Keyspaces

Patch by Russell Spitzer; Reviewed by Jeff Jirsa for CASSANDRA-13184
---
 doc/source/cql/security.rst | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/doc/source/cql/security.rst b/doc/source/cql/security.rst
index 9efe27f2df..ada65176bd 100644
--- a/doc/source/cql/security.rst
+++ b/doc/source/cql/security.rst
@@ -472,6 +472,15 @@ For instance::
     REVOKE EXECUTE ON FUNCTION keyspace1.user_function( int ) FROM report_writer;
     REVOKE DESCRIBE ON ALL ROLES FROM role_admin;
 
+Because of their function in normal driver operations, certain tables cannot have their `SELECT` permissions
+revoked. The following tables will be available to all authorized users regardless of their assigned role::
+
+* `system_schema.keyspaces`
+* `system_schema.columns`
+* `system_schema.tables`
+* `system.local`
+* `system.peers`
+
 .. _list-permissions-statement:
 
 LIST PERMISSIONS