Privileges

A privilege is a right to perform a privileged operation on the system. For example, altering a table is a privileged operation, depending on the type of alteration you are making.

There are two types of privileges: system privileges and object-level privileges.

System privileges give you the general right to perform a privileged operation, while object-level privileges restrict you to performing the operation on a specific object. For example, if you have the ALTER ANY TABLE system privilege, you can alter any table in the system. If you have the ALTER TABLE system privilege, you can only alter tables you own, or tables on which you have been granted the ALTER object-level privilege. They can be granted or revoked, but not created or dropped.

System privileges are built in to the database and can be granted or revoked, but not created or dropped. With the exception of the MANAGE ROLES and UPGRADE ROLE privileges, system privileges cannot be modified. Each system privilege, with the exception of the SET USER system privilege, is granted by default to either the SYS_AUTH_SA_ROLE or SYS_AUTH_SSO_ROLE role, but not both. The SET USER system privilege is granted to both roles.

You grant and revoke system and object-level privileges by using the GRANT and REVOKE statements.

• Privileges Versus Permissions
  Permission and privilege do not mean the same thing in role-based security. A user may have been granted the privilege required to perform an authorized task, but not have the necessary permission to perform the authorized task on the required object.
• System Privileges
  System privileges let you control access to authorized system operations. Each privileged database task on the server requires specific system privileges. System privileges can be granted individually to users or roles.
• Object-Level Privileges
  Database object-level privileges can be granted to and revoked from users.
• System Procedure Privileges
  There are two security models under which privileged system procedures can run. Each model grants the ability to run the system procedure differently.