I'm not succeeding in understanding permissions on Embedded Firebird.

I created a DB successfully, but now, although I can access its
metadata (e.g. table definitions) in a tool such as the EMS IB/FB
Manager Lite, if I try to access the data ("select * from CATEGORY"),
I get the message:

"This user does not have privilege to perform this operation on this
object.no permission for read/select access to COLUMN categorynum."

I don't seem to be able to create users (which is what I expected,
from the embedded readme), though I can create roles.

I tried to grant permission on the table "category" to public,
thinking that might work, but I get the following error:

"This operation is not defined for system tables.unsuccessful
metadata update.
no S privilege with grant option on table/view category."

The "category" table I'm trying to set permission on is a user-
defined table, not a system table.

Where can I learn about how permissions work on the embedded DB?

I am really hoping that in my delivered application using embedded
FB, I will be able to prevent the users from updating the DB via any
method other than using my program, but from what I've been reading
it seems like it will be entirely open. Is that right?