-- DDS execution evidence: durable FGA audit for the protected vector view.
-- Run as ADMIN/AUDIT_ADMIN. In unified auditing the records are queried from
-- UNIFIED_AUDIT_TRAIL with AUDIT_TYPE = 'FineGrainedAudit'.
BEGIN
  DBMS_FGA.DROP_POLICY(
    object_schema => 'ADMIN', object_name => 'CB_DDS_VECTOR_SEARCH_DOCUMENTS',
    policy_name => 'DDS_VECTOR_EXECUTION_EVIDENCE');
EXCEPTION WHEN OTHERS THEN
  IF SQLCODE != -28102 THEN RAISE; END IF;
END;
/
BEGIN
  DBMS_FGA.ADD_POLICY(
    object_schema => 'ADMIN',
    object_name => 'CB_DDS_VECTOR_SEARCH_DOCUMENTS',
    policy_name => 'DDS_VECTOR_EXECUTION_EVIDENCE',
    audit_condition => NULL,
    audit_column => NULL,
    statement_types => 'SELECT',
    audit_trail => DBMS_FGA.DB_EXTENDED,
    enable => TRUE);
END;
/
-- Evidence lookup (grant AUDIT_VIEWER or expose a definer-rights reader view
-- to the backoffice; never grant this to DDS END USER accounts):
-- SELECT event_timestamp, client_identifier, dbusername, object_name,
--        return_code, sql_text, application_contexts
-- FROM unified_audit_trail
-- WHERE audit_type = 'FineGrainedAudit'
--   AND object_schema = 'ADMIN'
--   AND object_name = 'CB_DDS_VECTOR_SEARCH_DOCUMENTS'
-- ORDER BY event_timestamp DESC;