--- In Firebird-Architect@yahoogroups.com, David Johnson
<johnson_d@c...> wrote:

> In a pooled connection environment, the user that established the
> initial connection needs rights to log in and to prepare statements,

but

> does not need rights to execute statements or view data. The
> application user will be tied to a connection for the duration of a
> single transaction, so the transaction user+role must override the
> connection user ID. No prepares should (generally) occur during any
> end-user transaction. On commit/rollback, the connection authorities
> should revert to the connection user.
>

The corrollary rule in the environment with application servers using
connection pooling is that application users+roles need rights to view
data but not to establish a connection.