# SQLCODE -552: Missing privilege for the operation Source: https://wndsoftware.com/mainframe-errors/sqlcode-552 ### SQLCODE -552: Missing privilege for the operation SQLCODE -552 (SQLSTATE 42502) means the authorization ID or role running the statement doesn't hold the privilege needed for the operation named in the message. The message names the ID and the operation but no object. #### Other names for this code Also written as `SQL -552`, `SQLCODE=-552`, `SQLCODE = -552`, `db2 -552`, `sqlstate 42502`, `SQL0552N`, `does not have the privilege to perform operation`. ### What it means The message has two tokens. The first is the authorization ID Db2 checked. The second is the operation it tried. Unlike -551, there is no object name, because the missing authority is usually a system privilege or one tied to the kind of operation. Creating a database or a storage group is a typical case. In a trusted context, the message may show a role instead, in the form ROLE: role-name. That happens when a role was in effect and Db2 checked the role rather than the user. If your shop uses RACF to control Db2 access through the access control authorization exit, the ID in the -552 message can differ from the user ID in any ICH408I message for the same failure. The ICH408I ID is the one RACF actually checked. Revoking system DBADM, DATAACCESS, ACCESSCTRL or CREATE_SECURE_OBJECT needs SECADM authority. Trying it without SECADM is one more way to get -552. ### Common causes - The ID lacks a system privilege for the statement, for example CREATEDBA or CREATEDBC for CREATE DATABASE, CREATESG for CREATE STOGROUP, or CREATEALIAS for CREATE ALIAS. - The job runs under a different ID from the one you tested with. Batch jobs run under the job's user, and CURRENT SQLID may point at a different ID than you expect. - The privilege is held by a RACF group, but that group isn't one of the job's secondary IDs. - Db2 security is managed in RACF and the matching profile is missing or doesn't permit the user. - In a trusted context, the role in effect doesn't hold the privilege. - A REVOKE of DBADM, DATAACCESS, ACCESSCTRL or CREATE_SECURE_OBJECT was issued without SECADM. ### How to find the problem - Take the ID and the operation from the message. - If RACF controls Db2 access, look in the job log or SYSLOG for an ICH408I at the same time. It names the profile and the user RACF checked. - Check the ID's system privileges with `SELECT * FROM SYSIBM.SYSUSERAUTH WHERE GRANTEE = 'PAYDBA1'`, and repeat it for the RACF groups the user belongs to. - Check what the job set CURRENT SQLID to, and which user the job ran under in the JES job log. ### How to fix it - Ask the security administrator or DBA to grant the privilege, for example `GRANT CREATEDBC TO PAYDBA1`, or to grant it to a group the user is in. - If RACF controls Db2 access, have the security team permit the user to the profile named in ICH408I. - Run the work under an ID that already holds the privilege, or SET CURRENT SQLID to a group that does. - Have an ID with SECADM issue revokes of the security-related authorities. ### IBM documentation [IBM documentation: -552](https://www.ibm.com/docs/en/db2-for-zos/13.0.0?topic=codes-552). Use the documentation for your installed release. [Report a correction to WND Software](https://wndsoftware.com/contact#message). Technical reviewer: [Albert Joseph](https://wndsoftware.com/authors/albert-joseph), WND Software. Last reviewed 2026-10-18 by the WND Software team. Written in our own words. For the full reference, check IBM’s Db2 for z/OS documentation for your release. ### Related codes [SQLCODE -551 Not authorized for the operation Read →](https://wndsoftware.com/mainframe-errors/sqlcode-551) [SQLCODE -567 Bind authorization error Read →](https://wndsoftware.com/mainframe-errors/sqlcode-567) [SQLCODE -922 Authorization failure Read →](https://wndsoftware.com/mainframe-errors/sqlcode-922) [ICH408I RACF denied access Read →](https://wndsoftware.com/mainframe-errors/ich408i) [SQLCODE -204 Undefined object name Read →](https://wndsoftware.com/mainframe-errors/sqlcode-204) ### Questions #### What is the difference between -551 and -552? -551 is a missing privilege on a named object, such as SELECT on a table, and the message names the object. -552 is a missing privilege for an operation, usually a system privilege, and the message names only the operation. #### Why does the ID in -552 differ from the one in ICH408I? When RACF does the checking, it may check a different ID from the one Db2 reports. Trust the ICH408I ID when you ask for RACF access. #### Is -552 the same on Db2 for LUW? Yes. Db2 for LUW reports SQL0552N with SQLSTATE 42502 when an ID lacks the privilege for an operation. [Db2 SQLCODEs](https://wndsoftware.com/mainframe-errors/db2-sqlcodes) · [SQLCODE -551](https://wndsoftware.com/mainframe-errors/sqlcode-551) · [SQLCODE -567](https://wndsoftware.com/mainframe-errors/sqlcode-567) [← All error codes](https://wndsoftware.com/mainframe-errors/)