Ok, I see.
Is it possible that in your 15.5 environment IT_READONLY is defined as a group while in your 15.7 environment it is defined as a role ?
What is the output of :
select * from AMANDA..sysusers where name = 'IT_READONLY'
select * from AMANDA..sysroles where lrid = <the uid or gid number of the previous output>
select * from master..syssrvroles where name = 'IT_READONLY'
My guess is that this is the difference between your 15.5 and 15.7 environment.
The revoke you discribe only works for groups and not for roles.
And my guess is that this is due to the fact that a user can only belong to one group in a database, but to multiple roles. If permission is granted to role_1, revoked from role_2, and a user belongs to both roles, then what should his permission be ? And would this depend on when he was assigned role_1 before role_2 or vice versa ? This seems too complicated.
Luc.