FRAGMENT privileges - no SELECT?

IDS 2000, 9.21.UC2, Linux. One of the (several) objectives of FRAGMENT(ing) a table BY EXPRESSION can be to enhance the granularity of security permissions over table data, providing row-group-level security. CREATE TABLE employee ( employee_id INTEGER NOT NULL PRIMARY KEY, salary INTEGER NOT NULL ) FRAGMENT BY EXPRESSION salary<=50000 IN dbspace1, salary>50000 IN dbspace2; Access to fragments of a table can then be granted using GRANT FRAGMENT. GRANT FRAGMENT [FRAGMENT LEVEL PRIVILEGE] ON employee(dbspace2) tohrmanager; Problem is, FRAGMENT LEVEL PRIVILEGE = [ALL, INSERT, DELETE, UPDATE], where ALL = I+D+U. So, my questions are :- 1) If a database user does not have select on the table, how can you grant them select on the fragment? 2) Why would select not be available as a fragment privilege? 3) Does anyone know if you can GRANT FRAGMENT to a ROLE (not according to my manual)? I am aware that database views can also be used quite effectively to provide row-level security, I'm just wondering why the FRAGMENT functionality is restricted so ... Thanks in advance for replies. Brett Randall

Hi All, Sorry for the repost. No responses to my original post. Does anyone have any opinions/comments/agreement? If not, I'll leave the thread here. Brett Randall Brett Randall wrote: > > IDS 2000, 9.21.UC2, Linux. > > One of the (several) objectives of FRAGMENT(ing) a table BY EXPRESSION > can be to enhance the granularity of security permissions over table > data, providing row-group-level security. > > CREATE TABLE employee > ( > employee_id INTEGER NOT NULL PRIMARY KEY, > salary INTEGER NOT NULL > ) FRAGMENT BY EXPRESSION salary<=50000 IN dbspace1, > salary>50000 IN dbspace2> ; > > Access to fragments of a table can then be granted using GRANT FRAGMENT. > > GRANT FRAGMENT [FRAGMENT LEVEL PRIVILEGE] ON employee(dbspace2) to> hrmanager; > > Problem is, FRAGMENT LEVEL PRIVILEGE = [ALL, INSERT, DELETE, UPDATE], > where ALL = I+D+U. > > So, my questions are :- > > 1) If a database user does not have select on the table, how can you > grant them select on the fragment? > 2) Why would select not be available as a fragment privilege? > 3) Does anyone know if you can GRANT FRAGMENT to a ROLE (not according > to my manual)? > > I am aware that database views can also be used quite effectively to > provide row-level security, I'm just wondering why the FRAGMENT > functionality is restricted so ... > > Thanks in advance for replies. > Brett Randall