Data Authorization Views

20.1 Data Authorization Views

These views help you validate data role definitions, data grant assignments, and the resulting row-level and column-level authorization rules.

Summary of views

View or Object Name	Description
`DBA_DATA_ROLES`	Displays all data roles defined in the database.
`DBA_DATA_ROLE_GRANTS`	Displays all data role grants and database role grants to data roles.
`DBA_DATA_GRANTS`	Displays all fine-grained data grants in the database.
`ALL_DATA_GRANTS`	Displays all fine-grained data grants accessible to the current user.
`USER_DATA_GRANTS`	Displays all fine-grained data grants owned by the current user.
`DBA_REQUIRED_PARENT_DATA_PRIVILEGES`	Displays the required parent data privileges of all cross-table data grants in the database.
`ALL_REQUIRED_PARENT_DATA_PRIVILEGES`	Displays the required parent data privileges of cross-table data grants accessible to the current user.
`USER_REQUIRED_PARENT_DATA_PRIVILEGES`	Displays the required parent data privileges of cross-table data grants owned by the current user.

20.1.1 DBA_DATA_ROLES

Displays all data roles defined in the database. Data roles can be locally defined or externally mapped to IAM attributes (for example, Entra ID roles). Data roles that are externally mapped activate automatically when the corresponding claim is present in the end-user token.

Column	Datatype	Description
`DATA_ROLE`	`VARCHAR2(128)`	Name of the data role
`MAPPED_TO`	`VARCHAR2(4000)`	External name (from IAM) that a data role maps to.
`ENABLED_BY_DEFAULT`	`BOOLEAN`	Indicates whether the data role is enabled by default (`TRUE`) or not (`FALSE`)

20.1.2 DBA_DATA_ROLE_GRANTS

Displays data role grants to data roles, end users, or application identities, and database role grants to data roles. Each row represents a single grant with optional temporal validity constraints.

Column	Datatype	Description
`DATA_ROLE`	`VARCHAR2(128)`	Name of the granted role
`ROLE_TYPE`	`VARCHAR2(13)`	Type of granted role: `DATA` `ROLE` `DATABASE` `ROLE`
`GRANTEE`	`VARCHAR2(128)`	Name of the grantee
`GRANTEE_TYPE`	`VARCHAR2(20)`	Type of grantee: `APPLICATION` `IDENTITY` `DATA` `ROLE` `END` `USER`
`START_TIME`	`VARCHAR2(28)`	Start time from which the grant is valid
`END_TIME`	`VARCHAR2(28)`	End time until which the grant is valid

20.1.3 DBA_DATA_GRANTS

Displays all Oracle Deep Data Security (Deep Sec) data grants in the database, created using the CREATE DATA GRANT statement. Because predicated grants contain unique attributes, such as grant names and active time windows (start or end times), they are not recorded in the standard DBA_TAB_PRIVS view. Instead, Deep Sec data grants appear exclusively in this dedicated dictionary view.

Note the distinction between the two ownership columns: OBJECT_OWNER identifies the schema of the target object being protected, whereas OWNER identifies the schema that owns the data grant itself.

Column	Datatype	NULL	Description
`OWNER`	`VARCHAR2(128)`		Owner of the data grant
`GRANT_NAME`	`VARCHAR2(128)`		Name of the data grant
`PRIVILEGE`	`VARCHAR2(128)`		Type of privilege granted
`COLUMN_NAME`	`VARCHAR2(128)`		Name of the column to which the data grant applies `NULL` if the granted privilege is not a column privilege
`GRANTED_WITH_ALL_COLUMNS_EXCEPT`	`VARCHAR2(128)`		Name of the column to which the data grant applies, if granted using the `ALL` `COLUMNS` `EXCEPT` clause `NULL` if the granted privilege is not a column privilege or if the privilege was not granted using the `ALL` `COLUMNS` `EXCEPT` clause
`OBJECT_OWNER`	`VARCHAR2(128)`		Owner of the object to which the data grant applies
`OBJECT_NAME`	`VARCHAR2(128)`	`NOT NULL`	Name of the object to which the data grant applies
`OBJECT_TYPE`	`VARCHAR2(24)`		Type of object to which the data grant applies (such as `TABLE`, `VIEW`)
`PREDICATE`	`VARCHAR2(4000)`		Predicate used for the data grant
`GRANTEE`	`VARCHAR2(128)`		Name of the grantee Applies to data grants created with `datagrant_option` only; `NULL` for cross-table data grants
`GRANTEE_TYPE`	`VARCHAR2(30)`		Type of grantee: `DATA` `ROLE` `END` `USER` Applies to data grants created with `datagrant_option` only; `NULL` for cross-table data grants
`USE_DATA_GRANTS_ONLY`	`BOOLEAN`		Indicates whether `USE` `DATA` `GRANTS` `ONLY` is enabled for the object to which the data grant applies (`TRUE`) or not (`FALSE`)
`CROSS_TABLE_DATA_GRANT`	`BOOLEAN`		Indicates whether this is a cross-table data grant (`TRUE`) or not (`FALSE`)
`START_TIME`	`TIMESTAMP(6) WITH TIME ZONE`		Start time for the data grant, if specified Applies to data grants created with `datagrant_option` only; `NULL` for cross-table data grants
`END_TIME`	`TIMESTAMP(6) WITH TIME ZONE`		End time for the data grant, if specified Applies to data grants created with `datagrant_option` only; `NULL` for cross-table data grants
`INVALID_COLUMN_NAME`	`VARCHAR2(128)`		Displays the column name if the data grant on the column is no longer valid due to, for example, a column name change or a dropped column `NULL` if the granted privilege is not a column privilege or if the column is valid For cross-table data grants, this column reports invalid columns of the child object. Invalid columns of the parent object are reported in the `INVALID_COLUMN_NAME` column of `DBA_REQUIRED_PARENT_DATA_PRIVILEGES`

20.1.4 ALL_DATA_GRANTS

Displays all Oracle Deep Data Security (Deep Sec) data grants that are accessible to the current user.

Column	Datatype	NULL	Description
`OWNER`	`VARCHAR2(128)`		Owner of the data grant
`GRANT_NAME`	`VARCHAR2(128)`		Name of the data grant
`PRIVILEGE`	`VARCHAR2(128)`		Type of privilege granted
`COLUMN_NAME`	`VARCHAR2(128)`		Name of the column to which the data grant applies `NULL` if the granted privilege is not a column privilege
`GRANTED_WITH_ALL_COLUMNS_EXCEPT`	`VARCHAR2(128)`		Name of the column to which the data grant applies, if granted using the `ALL` `COLUMNS` `EXCEPT` clause `NULL` if the granted privilege is not a column privilege or if the privilege was not granted using the `ALL` `COLUMNS` `EXCEPT` clause
`OBJECT_OWNER`	`VARCHAR2(128)`		Owner of the object to which the data grant applies
`OBJECT_NAME`	`VARCHAR2(128)`	`NOT NULL`	Name of the object to which the data grant applies
`OBJECT_TYPE`	`VARCHAR2(24)`		Type of object to which the data grant applies (such as `TABLE`, `VIEW`)
`PREDICATE`	`VARCHAR2(4000)`		Predicate used for the data grant
`GRANTEE`	`VARCHAR2(128)`		Name of the grantee Applies to data grants created with `datagrant_option` only; `NULL` for cross-table data grants
`GRANTEE_TYPE`	`VARCHAR2(30)`		Type of grantee: `DATA` `ROLE` `END` `USER` Applies to data grants created with `datagrant_option` only; `NULL` for cross-table data grants
`USE_DATA_GRANTS_ONLY`	`BOOLEAN`		Indicates whether `USE` `DATA` `GRANTS` `ONLY` is enabled for the object to which the data grant applies (`TRUE`) or not (`FALSE`)
`CROSS_TABLE_DATA_GRANT`	`BOOLEAN`		Indicates whether this is a cross-table data grant (`TRUE`) or not (`FALSE`)
`START_TIME`	`TIMESTAMP(6) WITH TIME ZONE`		Start time for the data grant, if specified Applies to data grants created with `datagrant_option` only; `NULL` for cross-table data grants
`END_TIME`	`TIMESTAMP(6) WITH TIME ZONE`		End time for the data grant, if specified Applies to data grants created with `datagrant_option` only; `NULL` for cross-table data grants
`INVALID_COLUMN_NAME`	`VARCHAR2(128)`		Displays the column name if the data grant on the column is no longer valid due to, for example, a column name change or a dropped column `NULL` if the granted privilege is not a column privilege or if the column is valid For cross-table data grants, this column reports invalid columns of the child object. Invalid columns of the parent object are reported in the `INVALID_COLUMN_NAME` column of `ALL_REQUIRED_PARENT_DATA_PRIVILEGES`

20.1.5 USER_DATA_GRANTS

Displays all Oracle Deep Data Security (Deep Sec) data grants that are owned by the current user.

Column	Datatype	NULL	Description
`GRANT_NAME`	`VARCHAR2(128)`		Name of the data grant
`PRIVILEGE`	`VARCHAR2(128)`		Type of privilege granted
`COLUMN_NAME`	`VARCHAR2(128)`		Name of the column to which the data grant applies `NULL` if the granted privilege is not a column privilege
`GRANTED_WITH_ALL_COLUMNS_EXCEPT`	`VARCHAR2(128)`		Name of the column to which the data grant applies, if granted using the `ALL` `COLUMNS` `EXCEPT` clause `NULL` if the granted privilege is not a column privilege or if the privilege was not granted using the `ALL` `COLUMNS` `EXCEPT` clause
`OBJECT_OWNER`	`VARCHAR2(128)`		Owner of the object to which the data grant applies
`OBJECT_NAME`	`VARCHAR2(128)`	`NOT NULL`	Name of the object to which the data grant applies
`OBJECT_TYPE`	`VARCHAR2(24)`		Type of object to which the data grant applies (such as `TABLE`, `VIEW`)
`PREDICATE`	`VARCHAR2(4000)`		Predicate used for the data grant
`GRANTEE`	`VARCHAR2(128)`		Name of the grantee Applies to data grants created with `datagrant_option` only; `NULL` for cross-table data grants
`GRANTEE_TYPE`	`VARCHAR2(30)`		Type of grantee: `DATA` `ROLE` `END` `USER` Applies to data grants created with `datagrant_option` only; `NULL` for cross-table data grants
`USE_DATA_GRANTS_ONLY`	`BOOLEAN`		Indicates whether `USE` `DATA` `GRANTS` `ONLY` is enabled for the object to which the data grant applies (`TRUE`) or not (`FALSE`)
`CROSS_TABLE_DATA_GRANT`	`BOOLEAN`		Indicates whether this is a cross-table data grant (`TRUE`) or not (`FALSE`)
`START_TIME`	`TIMESTAMP(6) WITH TIME ZONE`		Start time for the data grant, if specified Applies to data grants created with `datagrant_option` only; `NULL` for cross-table data grants
`END_TIME`	`TIMESTAMP(6) WITH TIME ZONE`		End time for the data grant, if specified Applies to data grants created with `datagrant_option` only; `NULL` for cross-table data grants
`INVALID_COLUMN_NAME`	`VARCHAR2(128)`		Displays the column name if the data grant on the column is no longer valid due to, for example, a column name change or a dropped column `NULL` if the granted privilege is not a column privilege or if the column is valid For cross-table data grants, this column reports invalid columns of the child object. Invalid columns of the parent object are reported in the `INVALID_COLUMN_NAME` column of `USER_REQUIRED_PARENT_DATA_PRIVILEGES`

20.1.6 DBA_REQUIRED_PARENT_DATA_PRIVILEGES

Displays the required parent data privileges of all cross-table data grants in the database.

Each row represents one privilege (optionally scoped to a single column of the parent object) that must be held on the parent object for the cross-table data grant to authorize access to its child object. Use this view together with DBA_DATA_GRANTS, which describes the privileges granted on the child object.

Column	Datatype	Description
`OWNER`	`VARCHAR2(128)`	Owner of the cross-table data grant
`GRANT_NAME`	`VARCHAR2(128)`	Name of the cross-table data grant
`PRIVILEGE`	`VARCHAR2(128)`	Privilege required on the parent object Can be `SELECT`, `INSERT`, `UPDATE`, or `DELETE`
`COLUMN_NAME`	`VARCHAR2(128)`	Name of the parent object column for a required column privilege There is one row for each column name specified in the required privilege `NULL` if the required privilege is not a column privilege
`CROSS_TABLE_OBJECT_OWNER`	`VARCHAR2(128)`	Owner of the parent object
`CROSS_TABLE_OBJECT_NAME`	`VARCHAR2(128)`	Name of the parent object
`CROSS_TABLE_OBJECT_TYPE`	`VARCHAR2(128)`	Type of the parent object (such as `TABLE` or `VIEW`)
`INVALID_COLUMN_NAME`	`VARCHAR2(128)`	Displays the name of the parent object column that is no longer valid because of a schema change (for example, a dropped or renamed column) `NULL` if the column is valid or if no column is specified

20.1.7 ALL_REQUIRED_PARENT_DATA_PRIVILEGES

Displays the required parent data privileges of cross-table data grants that are accessible to the current user.

A cross-table data grant is accessible to the current user when any of the following is true:

The current user is the owner of the data grant.
The current user has the ADMINISTER ANY DATA GRANT system privilege, which results in all cross-table data grants being displayed.
The current user has the ADMINISTER ANY DATA GRANT privilege at the schema level on the schema of the object on which the data grant is created, which results in the cross-table data grants in that schema being displayed.

Column	Datatype	Description
`OWNER`	`VARCHAR2(128)`	Owner of the cross-table data grant
`GRANT_NAME`	`VARCHAR2(128)`	Name of the cross-table data grant
`PRIVILEGE`	`VARCHAR2(128)`	Privilege required on the parent object Can be `SELECT`, `INSERT`, `UPDATE`, or `DELETE`
`COLUMN_NAME`	`VARCHAR2(128)`	Name of the parent object column for a required column privilege There is one row for each column name specified in the required privilege `NULL` if the required privilege is not a column privilege
`CROSS_TABLE_OBJECT_OWNER`	`VARCHAR2(128)`	Owner of the parent object
`CROSS_TABLE_OBJECT_NAME`	`VARCHAR2(128)`	Name of the parent object
`CROSS_TABLE_OBJECT_TYPE`	`VARCHAR2(128)`	Type of the parent object (such as `TABLE` or `VIEW`)
`INVALID_COLUMN_NAME`	`VARCHAR2(128)`	Displays the name of the parent object column that is no longer valid because of a schema change (for example, a dropped or renamed column) `NULL` if the column is valid or if no column is specified

20.1.8 USER_REQUIRED_PARENT_DATA_PRIVILEGES

Displays the required parent data privileges of cross-table data grants owned by the current user.

Column	Datatype	Description
`GRANT_NAME`	`VARCHAR2(128)`	Name of the cross-table data grant
`PRIVILEGE`	`VARCHAR2(128)`	Privilege required on the parent object Can be `SELECT`, `INSERT`, `UPDATE`, or `DELETE`
`COLUMN_NAME`	`VARCHAR2(128)`	Name of the parent object column for a required column privilege There is one row for each column name specified in the required privilege `NULL` if the required privilege is not a column privilege
`CROSS_TABLE_OBJECT_OWNER`	`VARCHAR2(128)`	Owner of the parent object
`CROSS_TABLE_OBJECT_NAME`	`VARCHAR2(128)`	Name of the parent object
`CROSS_TABLE_OBJECT_TYPE`	`VARCHAR2(128)`	Type of the parent object (such as `TABLE` or `VIEW`)
`INVALID_COLUMN_NAME`	`VARCHAR2(128)`	Displays the name of the parent object column that is no longer valid because of a schema change (for example, a dropped or renamed column) `NULL` if the column is valid or if no column is specified