# Revoking User Permissions

Administrators can revoke permissions for users to create consumers on a destination. Without permission, the user cannot create new consumers for a destination—however, existing consumers of the destination continue to receive messages.

You can only revoke a permission that is granted directly. That is, you cannot revoke a permission from a user that the user receives from a group. Also, you cannot revoke a permission that is inherited from a parent topic. The `revoke` command in `tibemsadmin` can only remove items from specific entries in the acl.conf file. The revoke command cannot remove items that are inherited from other entries.

You can revoke permissions in several ways:

- Remove or edit entries in the acl.conf file.
- Use the revoke commands in `tibemsadmin`.
- Use the administration APIs.

Copyright © Cloud Software Group, Inc. All rights reserved.