Single or separate users owning multiple Oracle Resource Groups?

Question

Being an infrastructure DBA, I have a question which I'm trying to sort out with my sys admin:
- We're trying to setup multiple Oracle 11g (non-RAC) instances on a two-node Solaris 10 cluster.
- each 'database' would have its own resource group, filesystem, binaries, and listener
- In order to fully separate the two instances, the SA actually gave us two different oracle accounts to control each resource group.
ie. a different oracle user (ie. oracle1, oracle2, oracle3) owns each resource group (/rg1, /rg2, /rg3)
- to patch/startup/shutdown each instance, we have to login as a separate user
- no user can run/touch the other's files (they're in completely different groups (dba/oinstall, dba2/oinstal2, dba3/oinstal3)
- to run patch/installing, we use a separate inventorypointer flag which points to that particular db's oraInventory (ie. ./runInstaller -invPtrLoc /var/opt/oracle/oraInst.loc.<resource_group_name>)
I asked why couldn't one user own all resource groups, and was told:
...Oracle uses the shared memory, semaphores and queues to exchange information. Each IPC object has an identifier and access information, similar to files (owner, ,group, mode). If you use the single oracle account in different RGs, you or system might accidentally destroy the IPC object which belongs to other Resource Group.
Is this true? I could have sworn I've seen other solaris setups (albeit with Veritas Resource Groups) setups which have multiple resource groups owned/managed by a single oracle user, but I don't know enough about semaphores and shared memory to truly understand his argument.
The way I was hoping to work would be:
- a single oracle user owning several resource groups
- each resource group mapping to a filesystem tree, ie:
     /home
          /oracle
     /rg1
          /opt
               /oracle
     /rg2
          /opt
               /oracle
     /rg3
          /opt
               /oracle- shared /var/opt/oracle/oratab
- to switch between instances, the oracle user simply does the same '. oraenv' command as regular.
I understand it can be done, just that I need something to counter my SA's argument that there would be potential IPC/shared memory/semaphore collisions.

Answer 1

I've marked the question as answered, to a degree: I can agree that there are successful implementations out there with one person running multiple solaris zones, I just couldn't explain it to the SA in an articulate manner. I've gone to Oracle Metalink with a service request and will post references to the notes that the support person gave me on the subject. It's good for research in this area:
Note 15654.1 TECH: Calculating Oracle's SEMAPHORE Requirements
Note 70688.1 Location and Display of kernel parameters - Solaris
Note 33244.1 SOLARIS: Shared Memory and Semaphore Kernel Parameters on Solaris (SPARC) Servers
Note 153961.1 Semaphores and Shared Memory - An Overview
We've ruled out local zones at the time, for other implementation reasons. What I think we're looking at is the trade-off between Sysadmin's management complexity (separate zones) and DB Admin's management complexity (separate users).