If a create revision contains users or roles, the revision will include only grant permissions on the VDP elements included in the revision.
Thus, to promote the privileges over an VDP element between environments you need create a revision selecting the VDP element (data source, view, web service, etc.) and all the users and roles that exist in the target environment.
The users, roles and privileges will be included in the VQL only when the user used creating the revision has admin permission in the Virtual Database that contains the Virtual DataPort elements.
Deploy that revision will grant permissions for the selected users and roles on the VDP element in the target environment. Deploy that revision with users/roles and privileges will never drop user or roles:
the users and roles non existent in the target environment will be created
the users and roles already existent in the target environment will be updated
A drop revision does not allow to revoke permission for users or roles on the VDP elements. The users, roles and VDP elements included in the revision will be removed during the deployment.