FB 1.5.2

I've just discovered that any user who can log into the server can
create any table they want, and presumably other objects.

I want to allow users to query tables but certainly not create new
objects, unless they have been given permission to do so. MSSQL works
like that. Surely it would make FB simply unsuitabe as a serious multi-
user database.

Please somebody tell me I'm mistaken!

regards
Richard