The basic security model of SQL consists of three entities: objects, actions, and users. Objects are defined in the database schema. In SQL'89, the objects are tables, views, columns of tables, and columns of views. In SQL'92, the objects also include domains and assertions. In SQL3, objects will include user defined constructs.
Actions are the operations performed on objects. Actions include: select, insert, delete, update, and references. Users invoke actions on objects.
A privilege is an authorization to a user of an action on an object. A privilege is a 5-tuple:
(grantor, grantee, object, action, grantable)The grantor is a user who is authorized to perform the action on object and who is authorized to grant the authorization to perform the action on object to other users. The grantee is the user who receives the authorization to perform action on object from the grantor. The true/false flag grantable indicates whether the grantee is authorized to pass the authorization for performing action on object to other users.
At object creation time, a user is designated as the owner of the object. An owner is authorized to perform all actions on the object and to grant privilege to other users. No user, other than the owner, may perform any action on the object unless that privilege is granted by the owner or by a another user to whom the owner granted the privilege. The owner of the object, or another user granted that privilege by the owner, may revoke the privilege at any time. At that time, the privilege is revoked for the grantee and for any user which obtained the privilege from the grantee.