REVOKE is the opposite of GRANT. It has the same shape, with FROM in place of TO:

REVOKE INSERT, UPDATE, DELETE ON products FROM intern;

The role keeps every privilege that you do not name.

See who has what

The view information_schema.table_privileges has one row for each privilege on each table:

SELECT grantee, table_name, privilege_type
FROM information_schema.table_privileges
WHERE grantee = 'intern';

The grantee column is the role that received the privilege.

PUBLIC

PUBLIC is not a real role. It means every role, including roles that you create later:

GRANT SELECT ON categories TO PUBLIC;

A privilege granted to PUBLIC reaches every role. To take it away, revoke it from PUBLIC. A REVOKE from one role does not remove what the role gets through PUBLIC:

Check grants to PUBLIC before you trust that a role cannot read a table.