GRANT { SELECT | INSERT | UPDATE }(column_list)
   ON TABLE table_list | ON ALL TABLES IN SCHEMA schema_name [, ...]
   TO ROLE role_list

GRANT SELECT
    ON CHANGE STREAM change_stream_list
        | ON ALL CHANGE STREAMS IN SCHEMA schema_name [, ...] }
    TO ROLE role_list

GRANT SELECT ON VIEW view_list | ON ALL VIEWS IN SCHEMA schema_name [, ...]
    TO ROLE role_list

spanner> REVOKE SELECT ON ALL TABLES IN SCHEMA sch1 FROM ROLE guest;
Query OK (16.96 sec)