[Developer] #567 expose VPD effective SQL trace

sql/adb/33_agent_ords_sql_trace_grant.sql

@@ -0,0 +1,21 @@
+-- ============================================================
+-- 33_agent_ords_sql_trace_grant.sql
+-- Enable the optional VPD predicate trace for an existing ORDS install.
+--
+-- Run as ADMIN after 26_agent_ords_security_dynamic_vpd_filter.sql.
+-- Then run 22_agent_ords_security_ords_handler_setup.sql as CB_ORDS, or
+-- save the trace-enabled Handler source from the backoffice UI.
+--
+-- The grant exposes only the existing predicate function to the ORDS
+-- runtime. It does not weaken DBMS_RLS enforcement or expose bearer values.
+-- ============================================================
+WHENEVER SQLERROR EXIT SQL.SQLCODE
+SET ECHO ON
+SET FEEDBACK ON
+
+PROMPT === Enabling ORDS VPD predicate trace ===
+GRANT EXECUTE ON cb_agent_doc_vpd_filter TO cb_ords;
+
+PROMPT === ORDS VPD predicate trace grant ready ===
+PROMPT Next: run 22_agent_ords_security_ords_handler_setup.sql as CB_ORDS
+EXIT;