> That statement is problematic since GRANT has always allowed
> multiple values to be granted to the target object. If
> multiple roles are granted to a procedure which should it
> execute under?

> Better would be something like
> ASSIGN <role name> TO PROCEDURE <procedure-name>;

Yes you are correct... I used the grant command only because it
would fit within the existing syntax. The fact that it would
have (slightly) different semantics is a problem, although I
was not certain it was a big problem.

The problem with "ASSIGN ..." is that it introduces a new
keyword (at least I dont think "assign" is a keyword yet).
Otherwise I like the way it reads/sounds.

Something like:
SET PROCEDURE <procedure> ROLE TO <role-name>;
uses existing keywords, but not sure it is otherwise suitable.

> BTW, I like your proposal a lot!

Thanks. From previous comments I getting nervous that I had
not been clear as to the purpose. I thought I could not be
the only one that has triggers trying to stop users from
doing stuff that I am happy for the "system" to do.

--
Geoff Worboys
Telesis Computing