New Apps User defaults with all User Edition Privileges - Security Breach?

Question

Please check the following Scenario/Issue and please let me know if anyone has a solution for it.
1. In Apps, created following Responsibilities
- Payables Inquiry-Only User
- Projects Inquiry-Only User
2. In Discoverer Admin, Tools->Privileges, assigned following privilege to "Payables Inquiry-Only User"
- User Edition Parent only (unchecked all child privileges such as Create/Edit Query)
3. In Discoverer Admin, Tools->Security, mapped following Responsibilities/Business Areas (BA)
- Resp: Payables Inquiry-Only User BA: AP Payables
- Resp: Projects Inquiry-Only User BA: PA Projects
4. In Apps, created user DISC_INQUIRY_USER, assigned following responsibilities
- Payables Inquiry-Only User
- Projects Inquiry-Only User
5. At this stage, if user connects to User Edition;
- user is able to create new query in BA: AP Payables or BA: PA Projects depending on login Responsibility
- By default Discoverer assigns all User Edition Privileges to new Apps User including Create/Edit Query
Requirement
1. Create new Apps User DISC_INQUIRY_USER, assign it Inquiry-Only Responsbilities
2. Login to User Edition - DISC_INQUIRY_USER: Payables Inquiry-Only User
- User can inquiry Workbooks associated with Resp: Payables Inqiry-Only user
- Should not be able to create new workbooks
3. Login to User Edition - DISC_INQUIRY_USER: Projects Inquiry-Only User
- User can inquiry Workbooks associated with Resp: Projects Inquiry-Only User
- Should not be able to create new workbooks
Issue
There is time-gap between creating Apps User and login to Discoverer Admin to remove user privileges. This is security Breach, is their any way to change get around it.
- Discoverer gives precedence to Responsibility Privileges over User Privileges. Is their any way to change it?
- Is it possible to change default Privileges for new Apps User?
- I am facing this issue in Discoverer 4.1.48, Does discoverer Admin behaves differently in latest Versions?

Answer 1

Nobody helps you except yourself. ;)
So, this query get privileges for user PUBLIC
select eap.ap_id, eap.gp_app_id
from eul5_eul_users eeu,
eul5_access_privs eap
where eeu.eu_username = 'PUBLIC'
and eap.ap_eu_id = eeu.eu_id
and eap.ap_type = 'GP'
In my case
3001     1000
3002     1001
3003     1002
3004     1003
3005     1004
3006     1005
3015     1013
3016     1014
3017     1018
3018     1024
I research а corresponding between gp_app_id (second column) and real name of privilege and get the next list:
1000     Discoverer and Plus Privilege
1001     Create/Edit Query
1002     Item Drill
1003     Drill Out
1004     Grant Workbook
1005     Collect Query Statistics
1006     Administration Privilege
1007     Set Privilege
1008     Create/Edit Business Area
1009     Format Business Area
1010     Create/Edit Summaries
1012     Schedule Workbook
1013     Unknown
1014     Save Workbooks to Database
1015     Manage Scheduled Workbooks
1018     Unknown
1024     Create Link
So, the ID of privilege 'Save Workbooks to Database' is 1014. This privilege exists in table in spite of in Discoverer Administrator this option UNCHECK for user PUBLIC.
This is a REAL BUG!!!
Then I executed query
delete from eul5_access_privs where ap_id = 3016
and after that all became right.
Now please explain me this bug. And I have question - which privileges have IDs 1013 and 1018?
Thank you.