Secure roles for data sharing

A system comprising:

• a memory;
• and
• a processing device operatively coupled to the memory, the processing device to:
• generate a set of secure roles that define a role hierarchy, wherein for each secure role of the set of secure roles;
• the secure role comprises an object assigned to a user;
• privileges on database objects are granted to the secure role via the object;
• and
• only a role that owns the secure role can grant any privilege to the secure role or modify any privilege granted to the secure role;
• generate an inherited grant that specifies a permission on a first type of object and a grant of the permission to a first secure role of the set of secure roles;
• in response to a role other than the role that owns the first secure role attempting to grant a privilege to the first secure role or modify a privilege granted to the first secure role, deny the attempt to preserve the role hierarchy;
• in response to a first object of a set of objects of the first type being referenced via the first secure role, create a virtual implied grant based on the inherited grant;
• and
• authorize utilization of the permission on the first object using the virtual implied grant, wherein the virtual implied grant is transient and exists in-memory only for the purpose of authorizing the utilization of the permission on the first object.

A non-transitory computer-readable medium having instructions stored thereon which, when executed by a processing device, cause the processing device to:

• generate a set of secure roles that define a role hierarchy, wherein for each secure role of the set of secure roles:
• the secure role comprises an object assigned to a user;
• privileges on database objects are granted to the secure role via the object;
• and
• only a role that owns the secure role can grant any privilege to the secure role or modify any privilege granted to the secure role;
• generate an inherited grant that specifies a permission on a first type of object and a grant of the permission to a first secure role of the set of secure roles;
• in response to a user other than the role that owns the first secure role attempting to grant a privilege to the first secure role or modify a privilege granted to the first secure role, deny the attempt to preserve the role hierarchy;
• in response to a first object of a set of objects of the first type being referenced via the first secure role, create a virtual implied grant based on the inherited grant;
• and
• authorize utilization of the permission on the first object using the virtual implied grant, wherein the virtual implied grant is transient and exists in-memory only for the purpose of authorizing the utilization of the permission on the first object.