Unexpected rights

Question

After creating a user, I set its privileges as follows. In many respects, this dose what I wanted such as the user was not able to create table, create materialized view etc.
However, to my surprises, the user can
A: drop materialized views, even though he cannot create a new one after he dropped it.
B: enable and disable constraints on a table.
Does anybody know why this is so? If I do not want the user to be able to issue any DDL at all, what should I do?
I need the analyze because after some major updates, an analyze is necessary because otherwise Oracle's CBO will not behave.
I need the ON COMMIT REFRESH because otherwise, insert into a table which impact a materialized view will cause problems.
I need to run the procedures and call the functions for obvious reasons.
Can I have all these but "revote alter any table" from the user? Where did I grant it in the first place?
Thanks.
SET SERVEROUTPUT ON;
GRANT ANALYZE ANY TO &&username;
GRANT DELETE ANY TABLE TO &&username;
GRANT INSERT ANY TABLE TO &&username;
GRANT SELECT ANY TABLE TO &&username;
GRANT UPDATE ANY TABLE TO &&username;
GRANT EXECUTE ANY LIBRARY TO &&username;
GRANT EXECUTE ANY PROCEDURE TO &&username;
GRANT "CONNECT" TO &&username;
GRANT SELECT ANY SEQUENCE TO &&username;
GRANT ON COMMIT REFRESH TO &&username;
ALTER USER &&username QUOTA UNLIMITED ON "USERS";

Answer 1

Hi,
Based on my test, child items’ owners didn’t change after the parent item’s owner changed. This should be a normal behavior since ownership is not an inheritable property.
In addition, after I changed ownership of C:\, the ACE scope didn’t change. Do you mind posting out the ACE scope change screenshots?
Best Regards,
Amy
Please remember to mark the replies as answers if they help and un-mark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact [email protected]