Predefined Roles in an Oracle AI Database Installation

Oracle AI Database provides a set of predefined roles to help in database administration.

These predefined role are automatically defined for Oracle databases when you run the standard scripts (such as catalog.sql and catproc.sql) that are part of database creation, and they are considered common roles. If you install other options or products, then other predefined roles may be created. You can find roles that are created and maintained by Oracle by querying the ROLE and ORACLE_MAINTAINED columns of the DBA_ROLES data dictionary view. If the output for ORACLE_MAINTAINED is Y, then you must not modify the role except by running the script that was used to create it.

Predefined Role	Description
`ACCHK_READ`	Provides privileges to use Application Continuity Protection Check (ACCHK), which includes the ability to query the following data dictionary views: `DBA_ACCHK_EVENTS` `DBA_ACCHK_EVENTS_SUMMARY` `DBA_ACCHK_STATISTICS` `DBA_ACCHK_STATISTICS_SUMMARY`Database administrators and PDB administrators grant this role to developers to read their results from ACCHK.
`ADM_PARALLEL_EXECUTE_TASK`	Provides privileges to update table data in parallel by using the `DBMS_PARALLEL_EXECUTE` PL/SQL package.
`AQ_ADMINISTRATOR_ROLE`	Provides privileges to administer Advanced Queuing. Includes `ENQUEUE ANY QUEUE`, `DEQUEUE ANY QUEUE`, and `MANAGE ANY QUEUE`, `SELECT` privileges on Advanced Queuing tables and `EXECUTE` privileges on Advanced Queuing packages.
`AQ_USER_ROLE`	De-supported, but kept mainly for release 8.0 compatibility. Provides `EXECUTE` privileges on the `DBMS_AQ` and `DBMS_AQIN` packages.
`AUDIT_ADMIN`	Provides privileges to create unified and fine-grained audit policies, use the `AUDIT` and `NOAUDIT` SQL statements, view audit data, and manage the audit trail administration
`AUDIT_VIEWER`	Provides privileges to view and analyze audit data
`AUTHENTICATEDUSER`	Used by the XDB protocols to define any user who has logged in to the system.
`AVTUNE_PKG_ROLE`	Is granted by default to the `DBMS_AVTUNE` package so that it can do its job. The `DBMS_AVTUNE` package is granted the role so that is has those privileges when it executes and the user does not need to have them.
`BDSQL_ADMIN`	Provides privileges to use the `DBMS_BDSQL` PL/SQL package
`BDSQL_USER`	Provides privileges to use Oracle Big Data SQL
`CAPTURE_ADMIN`	Provides the privileges necessary to create and manage privilege analysis policies.
`CDB_DBA`	Provides the privileges required for administering a CDB, such as `SET CONTAINER`, `SELECT ON PDB_PLUG_IN_VIOLATIONS`, and `SELECT ON CDB_LOCAL_ADMIN_PRIVS`. If your site requires additional privileges, then you can create a role (either common or local) to cover these privileges, and then grant this role to the `CDB_DBA` role.
`CONNECT`	Provides the `CREATE SESSION` system privilege. This role is provided for compatibility with previous releases of Oracle AI Database. You can determine the privileges encompassed by this role by querying the `DBA_SYS_PRIVS` data dictionary view. Note: Oracle recommends that you design your own roles for database security rather than relying on this role. This role may not be created automatically by future releases of Oracle AI Database.
`CTXAPP`	Provides privileges to create Oracle Text indexes and index preferences, and to use PL/SQL packages. This role should be granted to Oracle Text users.
`DATAPUMP_EXP_FULL_DATABASE`	Provides privileges to export data from an Oracle AI Database using Oracle Data Pump. Caution: This is a very powerful role because it provides a user access to any data in any schema in the database. Use caution when granting this role to users.
`DATAPUMP_IMP_FULL_DATABASE`	Provides privileges to import data into an Oracle AI Database using Oracle Data Pump. Caution: This is a very powerful role because it provides a user access to any data in any schema in the database. Use caution when granting this role to users.
`DB_DEVELOPER_ROLE`	Provides most of the system privileges, object privileges, predefined roles, PL/SQL package privileges, and tracing privileges that an application developer needs.
`DBA`	Provides a large number of system privileges, including the `ANY` privileges (such as the `DELETE ANY TABLE` and `GRANT ANY PRIVILEGE` privileges). This role is provided for compatibility with previous releases of Oracle AI Database. You can find the privileges that are encompassed by this role by querying the `DBA_SYS_PRIVS` data dictionary view. Note: Oracle recommends that you design your own roles for database security rather than relying on this role. This role may not be created automatically by future releases of Oracle AI Database.
`DBJAVASCRIPT`	Provided privileges for a schema to run JavaScript code, using the Nashorn engine of 12.2 Oracle JVM. Desupported.
`DBMS_MDX_INTERNAL`	Supports the `DBMS_MDX_ODBO` PL/SQL package. For internal use only.
`DGPDB_ROLE`	Grants privileges to the Oracle Data Guard account `DGPDB_INT`, which is an internal account
`DV_ACCTMGR`	Provides privileges to manage user accounts in an Oracle Database Vault environment
`DV_ADMIN`	Provides privileges to use the Oracle Database Vault PL/SQL packages
`DV_AUDIT_CLEANUP`	Provides privileges for purge operations in an Oracle Database Vault environment
`DV_DATAPUMP_NETWORK_LINK`	Provides privileges for performing Oracle Data Pump import operations in an Oracle Database Vault environment
`DV_GOLDENGATE_ADMIN`	Provides privileges to configure Oracle GoldenGate in an Oracle Database Vault environment
`DV_GOLDENGATE_REDO_ACCESS`	Provides privileges to use the Oracle GoldenGate `TRANLOGOPTIONS DBLOGREADER` method to access redo logs in an Oracle Database Vault environment
`DV_MONITOR`	Enables the Oracle Enterprise Manager Cloud Control agent to monitor Oracle Database Vault for attempted violations and configuration issues with realm or command rule definitions
`DV_OWNER`	Provides privileges to manage the Oracle Database Vault roles and its configuration
`DV_PATCH_ADMIN`	Provides privileges to perform patch operations in an Oracle Database Vault environment
`DV_POLICY_OWNER`	Provides privileges to manage to a limited degree Oracle Database Vault policies
`DV_SECANALYST`	Provides privileges to analyze Oracle Database Vault reports and monitor Oracle Database Vault
`DV_STREAMS_ADMIN`	Required for configuring Oracle Streams, which is deprecated, in an Oracle Database Vault environment
`DV_XSTREAM_ADMIN`	Required for configuring Oracle XStreams in an Oracle Database Vault environment
`DBFS_ROLE`	Provides access to the DBFS (the Database Filesystem) packages and objects.
`EJBCLIENT`	Provides privileges to connect to EJBs from a Java stored procedure.
`EXECUTE_CATALOG_ROLE`	Provides `EXECUTE` privileges on objects in the data dictionary.
`EXP_FULL_DATABASE`	Provides the privileges required to perform full and incremental database exports using the Export utility (later replaced with Oracle Data Pump). It includes these privileges: `SELECT ANY TABLE`, `BACKUP ANY TABLE`, `EXECUTE ANY PROCEDURE`, `EXECUTE ANY TYPE`, `ADMINISTER RESOURCE MANAGER`, and `INSERT`, `DELETE`, and `UPDATE` on the tables `SYS.INCVID`, `SYS.INCFIL`, and `SYS.INCEXP`. Also includes the following roles: `EXECUTE_CATALOG_ROLE` and `SELECT_CATALOG_ROLE`. This role is provided for convenience in using the export and import utilities. Caution: This is a very powerful role because it provides a user access to any data in any schema in the database. Use caution when granting this role to users.
`GATHER_SYSTEM_STATISTICS`	Provides privileges to update system statistics, which are collected using the `DBMS_STATS.GATHER_SYSTEM_STATISTICS` procedure
`GDS_CATALOG_SELECT`	Provides the read privilege to the Global Data Services (GDS) and sharding catalog tables that are owned by `GSMADMIN_INTERNAL`. This role was created primarily for Oracle Enterprise Manager support of GDS and shrading, but users can use it to run their own reports using GDS metadata.
`GLOBAL_AQ_USER_ROLE`	Provides privileges to establish a connection to an LDAP server, for use with Oracle Advanced Queuing
`GRAPH_ADMINISTRATOR`	Provides privileges to perform operations on the graph server (PGX) using the Java API (as compared to running start and stop operations as an OS user)
`GRAPH_DEVELOPER`	Provides privileges to create, publish, modify, query, and view graphs using the Java API or `SQLcl` or the graph visualization application
`GRAPH_USER`	Provides privileges to query and view graphs using the Java API or SQLcl or the graph visualization application
`GSMADMIN_ROLE`	Should be granted to Global Data Services (GDS) and sharding administrators, so that they can administer a GDS or sharding configuration
`GSMCATUSER_ROLE`	Granted only the Oracle delivered account `GSMCATUSER` for internal use
`GSMROOTUSER_ROLE`	Granted only to Oracle delivered account `GSMROOTUSER` for internal use
`GSMUSER_ROLE`	Granted only to Oracle delivered account `GSMUSER` for internal use
`GSM_POOLADMIN_ROLE`	Valid for GDS only (not for sharding). Should be granted to GDS pool administrators so that they can administer their GDS pool
`HS_ADMIN_EXECUTE_ROLE`	Provides the `EXECUTE` privilege for users who want to use the Heterogeneous Services (HS) PL/SQL packages
`HS_ADMIN_ROLE`	Provides privileges to both use the Heterogeneous Services (HS) PL/SQL packages and query the HS-related data dictionary views
`HS_ADMIN_SELECT_ROLE`	Provides privileges to query the Heterogeneous Services data dictionary views
`IMP_FULL_DATABASE`	Provides the privileges required to perform full database imports using the Import utility (later replaced with Oracle Data Pump). Includes an extensive list of system privileges (use view `DBA_SYS_PRIVS` to view privileges) and the following roles: `EXECUTE_CATALOG_ROLE` and `SELECT_CATALOG_ROLE`. This role is provided for convenience in using the export and import utilities. Caution: This is a very powerful role because it provides a user access to any data in any schema in the database. Use caution when granting this role to users.
`JAVADEBUGPRIV`	Provides privileges to run the Oracle AI Database Java applications debugger
`JAVAIDPRIV`	Deprecated for this release
`JAVASYSPRIV`	Provides major permissions to use Java2, including updating Oracle JVM-protected packages
`JAVAUSERPRIV`	Provides limited permissions to use Java2
`JAVA_ADMIN`	Provides administrative permissions to update policy tables for Oracle AI Database Java applications
`JMXSERVER`	Provides privileges to start and maintain a JMX agent in a database session
`LBAC_DBA`	Provides permissions to use the `SA_SYSDBA` PL/SQL package
`LOGSTDBY_ADMINISTRATOR`	Provides administrative privileges to manage the SQL Apply (logical standby database) environment
`OEM_ADVISOR`	Provides privileges to create, drop, select (read), load (write), and delete a SQL tuning set through the `DBMS_SQLTUNE` PL/SQL package, and to access to the Advisor framework using the `ADVISOR` PL/SQL package
`OEM_MONITOR`	Provides privileges needed by the Management Agent component of Oracle Enterprise Manager to monitor and manage the database
`OGG_APPLY`	Provides privileges to manage Oracle GoldenGate Replicat
`OGG_APPLY_PROCREP`	Provides privileges for using Oracle GoldenGate procedural replication
`OGG_CAPTURE`	Provides privileges to use Oracle GoldenGate Extract
`OGG_CAPTURE_SHARED`	Provides privileges for managing Oracle GoldenGate Shared Capture
`OLAP_DBA`	Provides administrative privileges to create dimensional objects in different schemas for Oracle OLAP
`OLAP_USER`	Provides application developers privileges to create dimensional objects in their own schemas for Oracle OLAP
`OLAP_XS_ADMIN`	Provides privileges to administer security for Oracle OLAP
`OPTIMIZER_PROCESSING_RATE`	Provides privileges to run the `GATHER_PROCESSING_RATE`, `SET_PROCESSING_RATE`, and `DELETE_PROCESSING_RATE` procedures in the `DBMS_STATS` package. These procedures manage the processing rate of a system for automatic degree of parallelism (Auto DOP). Auto DOP uses these processing rates to determine the optimal degree of parallelism for a SQL statement.
`OSAK_ADMIN_ROLE`	Provides privileges for an Oracle SQL Access to Kafka (OSAK) administrator to configure, register, and manage Kafka clusters
`PDB_DBA`	Granted automatically to the local user that is created when you create a new PDB from the seed PDB. No privileges are provided with this role.
`PGX_SERVER_GET_INFO`	Provides privileges to find status information on the property graph (PGX) instance using the Admin API
`PGX_SERVER_MANAGE`	Provides privileges to manage the PGX instance
`PGX_SESSION_ADD_PUBLISHED_GRAPH`	Provides privileges to create a new graph in PGX by loading from the database using a configuration file, using the `CREATE PROPERTY GRAPH` statement in PGQL, creating a sub-graph from another graph, or using the GraphBuilder
`PGX_SESSION_COMPILE_ALGORITHM`	Provides privileges to compile algorithms using the PGX Algorithm API
`PGX_SESSION_CREATE`	Provides privileges to create a new PGX session using the `ServerInstance.createSession` API
`PGX_SESSION_GET_PUBLISHED_GRAPH`	Provides privileges to query and view graphs published by another user to the public namespace
`PGX_SESSION_MODIFY_MODEL`	Provides privileges to create, train, and store an ML model using PgxML
`PGX_SESSION_NEW_GRAPH`	Provides privileges to create a new graph in PGX by loading from the database using a configuration file, using the `CREATE PROPERTY GRAPH` statement in PGQL, creating a sub-graph from another graph, or using the GraphBuilder
`PGX_SESSION_READ_MODEL`	Provides privileges to load and use an ML model using PgxML
`PPLB_ROLE`	Granted only to the Oracle Data Guard account `DGPDB_INT` for internal use. This role enables the `DGPDB_INT` account to access the pre-plugin backup tables when plugging new PDBs. Do not grant this role to any users or other roles.
`PROVISIONER`	Provides privileges to register and update global callbacks for Real Application Security sessions and to provision principals.
`RDFCTX_ADMIN`	Provides privileges for using the Semantic (Text) search feature of Resource Description Framework (RDF) graphs
`RECOVERY_CATALOG_OWNER`	Provides the following privileges for owner of the recovery catalog: `ADMINISTER DATABASE` `ALTER SESSION` `CREATE ANY CONTEXT` `CREATE ANY SYNONYM` `CREATE ANY TRIGGER` `CREATE CLUSTER` `CREATE DATABASE LINK` `CREATE PROCEDURE` `CREATE SEQUENCE` `CREATE SESSION` `CREATE SYNONYM` `CREATE TABLE` `CREATE TRIGGER` `CREATE VIEW` `DROP ANY SYNONYM` `EXECUTE ON DBMS_RLS` `QUERY REWRITE`
`RECOVERY_CATALOG_OWNER_VPD`	Provides privileges for recovery catalog management.
`RECOVERY_CATALOG_USER`	Provides privileges for recovery catalog management.
`RESOURCE`	Provides the following resource-related system privileges: `CREATE ANALYTIC VIEW` `CREATE ATTRIBUTE DIMENSION` `CREATE CLUSTER` `CREATE HIERARCHY` `CREATE INDEXTYPE` `CREATE MATERIALIZED VIEW` `CREATE OPERATOR` `CREATE PROCEDURE` `CREATE PROPERTY GRAPH` `CREATE SEQUENCE` `CREATE SYNONYM` `CREATE TABLE` `CREATE TRIGGER` `CREATE TYPE` `CREATE VIEW`Be aware that `RESOURCE` no longer provides the `UNLIMITED TABLESPACE` system privilege. This role is provided for compatibility with previous releases of Oracle AI Database. You can determine the privileges encompassed by this role by querying the `DBA_SYS_PRIVS` data dictionary view. Note: Oracle recommends that you design your own roles for database security rather than relying on this role. This role may not be created automatically by future releases of Oracle AI Database.
`SAGA_ADM_ROLE`	Provides the ability to invoke APIs from the `DBMS_SAGA_ADM` package. This role is required for saga administrators for the initial setup and provides full access to the `DBMS_SAGA_ADM` API.
`SAGA_CONNECT_ROLE`	Provided to the remote database link user when the Oracle saga framework is in use.
`SAGA_PARTICIPANT_ROLE`	Required for saga participant services. Saga primitives can only be invoked by a user that has the `SAGA_PARTICIPANT` role granted to it.
`SCHEDULER_ADMIN`	Allows the grantee to run the procedures of the `DBMS_SCHEDULER` package. It includes all of the job scheduler system privileges and is included in the `DBA` role.
`SELECT_CATALOG_ROLE`	Provides `SELECT` privilege on objects in the data dictionary.
`SHARDED_SCHEMA_OWNER`	Provides privileges for sharded schema owners to perform sharding administrative tasks on their own schema
`SODA_APP`	Provides privileges to use the SODA APIs, in particular, to create, drop, and list document collections.
`SQL_FIREWALL_ADMIN`	Provides the following privileges to administer SQL Firewall: `ADMINISTER SQL FIREWALL` system privilege `EXECUTE` privilege on the `DBMS_SQL_FIREWALL` PL/SQL package `SELECT` privilege for the `DBA_SQL_FIREWALL_`* data dictionary views
`SQL_FIREWALL_VIEWER`	Provides the `SELECT` privilege for the SQL Firewall `DBA_SQL_FIREWALL_`* data dictionary views
`WM_ADMIN_ROLE`	Provides administrative privileges for Oracle Workspace Manager. This enables users to run any `DBMS_WM` procedures on all version enabled tables, workspaces, and savepoints regardless of their owner. It also enables the user to modify the system parameters specific to Workspace Manager.
`XDBADMIN`	Allows the grantee to register an XML schema globally, as opposed to registering it for use or access only by its owner. It also lets the grantee bypass access control list (ACL) checks when accessing Oracle XML DB Repository (deprecated).
`XDB_SET_INVOKER`	Allows the grantee to define invoker’s rights handlers and to create or update the resource configuration for XML repository triggers. By default, Oracle AI Database grants this role to the `DBA` role but not to the `XDBADMIN` role.
`XDB_WEBSERVICES`	Allows the grantee to access Oracle AI Database Web services over HTTPS. However, it does not provide the user access to objects in the database that are public. To allow public access, you need to grant the user the `XDB_WEBSERVICES_WITH_PUBLIC` role. For a user to use these Web services, `SYS` must enable the Web service servlets.
`XDB_WEBSERVICES_OVER_HTTP`	Allows the grantee to access Oracle AI Database Web services over HTTP. However, it does not provide the user access to objects in the database that are public. To allow public access, you need to grant the user the `XDB_WEBSERVICES_WITH_PUBLIC` role.
`XDB_WEBSERVICES_WITH_PUBLIC`	Allows the grantee access to public objects through Oracle AI Database Web services.
`XSTREAM_APPLY`	Provides privileges to manage XStream In
`XSTREAM_CAPTURE`	Provides privileges to manage XStream Out
`XS_CACHE_ADMIN`	In Real Application Security, enables the grantee to manage the mid-tier cache. It is required for caching the security policy at the mid-tier level for the `checkAcl` (authorization) method of the `XSAccessController` class. Grant this role to the application connection user or the Real Application Security dispatcher.
`XS_NAMESPACE_ADMIN`	In Real Application Security, enables the grantee to manage and manipulate the namespace and attribute for a session. Grant this role to the Real Application Security session user.
`XS_RESOURCE`	In Real Application Security, enables the grantee to manage objects in the attached schema, through the `XS_ACL` PL/SQL package. This package creates procedures to create and manage access control lists (ACLs). It contains the `ADMIN SEC POLICY` privilege. It is similar to the Oracle AI Database `RESOURCE` role.
`XS_SESSION_ADMIN`	In Real Application Security, enables the grantee to manage the life cycle of a session, including the ability to create, attach, detach, and destroy the session. Grant this role to the application connection user or Real Application Security dispatcher.

Note: Each installation should create its own roles and assign only those privileges that are needed, thus retaining detailed control of the privileges in use. This process also removes any need to adjust existing roles, privileges, or procedures whenever Oracle AI Database changes or removes roles that Oracle AI Database defines. For example, the CONNECT role now has only one privilege: CREATE SESSION.