Adds **Revoking grants from a user** paragraph

doc/code_snippets/snippets/config/instances.enabled/credentials/revoke_all.yaml

@@ -0,0 +1,13 @@
+# empty permissions array:
+sampleuser:
+  password: '123456'
+  roles: [ writers_space_reader ]
+privileges:
+- permissions: [] # !! read permission revoked !!
+  spaces: [books]
+
+# empty privileges array:
+sampleuser:
+  password: '123456'
+  roles: [ writers_space_reader ]
+  privileges: [] # !! no privileges at all !!

doc/code_snippets/snippets/config/instances.enabled/credentials/revoke_one.yaml

@@ -0,0 +1,15 @@
+# grant privileges
+sampleuser:
+  password: '123456'
+  roles: [ writers_space_reader ]
+privileges:
+- permissions: [read, write]
+  spaces: [books]
+
+# revoke a privilege:
+sampleuser:
+  password: '123456'
+  roles: [ writers_space_reader ]
+  privileges:
+  - permissions: [read] # !! write permission revoked !!
+    spaces: [books]

doc/platform/connections_and_auth/credentials.rst

@@ -80,7 +80,38 @@ In this example, ``sampleuser`` gets privileges to select and modify data in the
 
 You can find the full example here: `credentials <https://github.com/tarantool/doc/tree/latest/doc/code_snippets/snippets/config/instances.enabled/credentials>`_.
 
+.. _configuration_credentials_managing_users_roles_revoking_privileges:
 
+Revoking privileges from a user
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+To revoke a previously granted privilege, remove it from the configuration.
+
+For example, here is how to to grant privileges to a space and how to revoke one of the privileges:
+
+..  literalinclude:: /code_snippets/snippets/config/instances.enabled/credentials/revoke_one.yaml
+    :language: yaml
+    :start-at: # grant privileges
+    :dedent:
+
+If you want to revoke the remaining privilege to from a space, you can remove it, too, thus making ``permissions`` an empty array:
+
+..  literalinclude:: /code_snippets/snippets/config/instances.enabled/credentials/revoke_all.yaml
+    :language: yaml
+    :start-at: # empty permissions array
+    :end-at: [ books ]
+    :dedent:
+
+You can revoke all privileges by making the ``privileges`` an empty array:
+
+..  literalinclude:: /code_snippets/snippets/config/instances.enabled/credentials/revoke_all.yaml
+    :language: yaml
+    :start-at: # empty privileges array
+    :dedent:
+
+..  warning::
+    Do not remove a user or a role from configuration in order to revoke that user's or role's privileges. If a user or a role is entirely 
+    removed from the configuration, it is not tracked by configuration machinery anymore. The user/role is not removed and its privileges are not revoked.
 
 .. _configuration_credentials_loading_secrets: