-- ============================================================
-- 33_agent_ords_sql_trace_grant.sql
-- Enable the optional VPD predicate trace for an existing ORDS install.
--
-- Run as ADMIN after 26_agent_ords_security_dynamic_vpd_filter.sql.
-- Then run 22_agent_ords_security_ords_handler_setup.sql as CB_ORDS, or
-- save the trace-enabled Handler source from the backoffice UI.
--
-- The grant exposes only the existing predicate function to the ORDS
-- runtime. It does not weaken DBMS_RLS enforcement or expose bearer values.
-- ============================================================
WHENEVER SQLERROR EXIT SQL.SQLCODE
SET ECHO ON
SET FEEDBACK ON

PROMPT === Enabling ORDS VPD predicate trace ===
GRANT EXECUTE ON cb_agent_doc_vpd_filter TO cb_ords;

PROMPT === ORDS VPD predicate trace grant ready ===
PROMPT Next: run 22_agent_ords_security_ords_handler_setup.sql as CB_ORDS
EXIT;