Privileges Versus Permissions

Permission and privilege do not mean the same thing in role-based security. A user may have been granted the privilege required to perform an authorized task, but not have the necessary permission to perform the authorized task on the required object.

A privilege grants a user or role the ability to perform a specific authorized task. Permission, however, refers to the context in which the task is being performed

When performing an authorized task, if a failure occurs, the error message that appears often indicates that the user does not have permission to perform the task, not that the user does not have the privilege to perform the task. Before executing a privileged task or operation, the system verifies that the user has the correct privilege to perform the:

privileged operation.
privileged operation on the acted-on. object
privilege operation in the context they are trying to do it in.

If the user does not have the correct privilege at any level, he or she is said to not have permission to perform the task. The operation fails and an error message appears.

Example

A user has been granted the ALTER privilege only on a text configuration object called Myconfig.

Object privilege: The user attempts to alter a text configuration object other than Myconfig. The task fails because the ALTER privilege granted to the user is specific to the Myconfig text object, not any text object.

Context privilege: The user attempts to drop a prefilter on Myconfig. Though the user has been granted the ALTER privilege on Myconfig, to drop a prefilter on a text configuration object requires the ALTER ANY TEXT CONFIGURATION or ALTER ANY OBJECT system privilege, which has not been granted to the user,