🚀 go-pugleaf

I am puzzled by the following and hope that those who are into C/S
development can help me. Coming from an IBM mainframe environment
and DB2, security of the data in DB2 was never an issue. If you
wrote an application to manipulate the data in a DB2 table(s) the
entire application would be accompanied by a PLAN which is an
encapulation of all the accesses to the tables that this application
would make. A user who wished to access this data would need to be
granted execute authority on this PLAN (an DB2 entity) before he
could run the appliation and potentially update the data. He could
not use any adhoc tools to even view that data if no explicit access
rights had been granted.

In the C/S world as I understand it, if a user signs onto to the
database and then runs an application, that user has to be
explicitly given the access rights the application needs (read,
write, update etc.) so there is no theoretical reason why that user
could not use some query tool to retrieve or update records outside
of the application. I am discounting stored procedures here - would
they make a difference?


----------------------------------------------------------------------
     Laurence Chiu                    Walnut Creek, California
     Tel: 510-412-4730(wk)            Internet: lchiu@crl.com