I don't understand why these commands don't work?!REVOKE CREATE ON SCHEMA public FROM u_tdb_ro;
REVOKE CREATE ON DATABASE tdb FROM u_tdb_ro;
REVOKE CREATE ON TABLESPACE pg_default FROM u_tdb_ro;
Because at no point has the system ever actually granted those specific permissions to that specific role. When you revoke something it has to have been previously granted. The underlying complication is permission inheritance. You need to know where in the inheritance chain a permission originates in order to know your options for removing it. In this case the grant to the public group that all roles are a member of.
David J.
