IBM Db2 11.1 Certification Guide

Role-based access control

Role-based access control security mechanisms have emerged as a preferred way to protect an organization's information. With this access control mechanism, you grant the privileges to roles instead of the users' authorization IDs. A role is a database object that groups together one or more privileges and can be assigned to users, groups, PUBLIC, or other roles.

If you want to create a role called developer, use the following CREATE ROLE statement:

CREATE ROLE developer; 

All of the Db2 privileges and authorities that you can grant within a database can also be granted to a role. For example, a role can be granted any of the following authorities and privileges:

• Database privileges, including DBADM, SECADM, DATAACCESS ...