diff --git a/scenarios/03-pii-row-column-cell/WORKSHOP.md b/scenarios/03-pii-row-column-cell/WORKSHOP.md
index 195e211..5e2ae90 100755
--- a/scenarios/03-pii-row-column-cell/WORKSHOP.md
+++ b/scenarios/03-pii-row-column-cell/WORKSHOP.md
@@ -130,6 +130,14 @@ sql 'emma/Welcome1_DDS!@ddslab_tunnel'
 
 Expected result: Emma sees her own authorized view.
 
+Run Emma's self-service phone update:
+
+```sql
+@scenarios/03-pii-row-column-cell/sql/05_update_phone_test.sql
+```
+
+Expected result: Emma can update only her own `PHONE` value.
+
 ### Task 4.2 - Marvin Manager Access
 
 ```sql
@@ -146,6 +154,8 @@ sql 'marvin/Welcome1_DDS!@ddslab_tunnel'
 
 Expected result: Marvin sees direct reports and not their `SSN`.
 
+Do not run `05_update_phone_test.sql` as Marvin for the core demo. That script represents employee self-service phone updates, while Marvin's manager-specific update permission is for `SALARY` on direct reports.
+
 ### Task 4.3 - Victoria HR Access
 
 ```sql
@@ -162,6 +172,8 @@ sql 'victoria/Welcome1_DDS!@ddslab_tunnel'
 
 Expected result: Victoria sees HR-authorized sensitive data.
 
+Do not run `05_update_phone_test.sql` as Victoria for the core demo. HR has read access in this lab, but the employee self-service phone update is intentionally tied to the employee role.
+
 ## Lab 5 - Clean Up
 
 ```sql
@@ -194,4 +206,3 @@ The trust chain is: **end-user identity -> DATA ROLE -> DATA GRANT -> row, colum
 - DDS supports row, column, and update controls in one model.
 - The database enforces the boundary even when SQL asks for too much.
 - PII protection is close to the data and independent of application-only filtering.
-
diff --git a/scenarios/03-pii-row-column-cell/sql/00_schema.sql b/scenarios/03-pii-row-column-cell/sql/00_schema.sql
index e919d2d..258f7a4 100755
--- a/scenarios/03-pii-row-column-cell/sql/00_schema.sql
+++ b/scenarios/03-pii-row-column-cell/sql/00_schema.sql
@@ -1,13 +1,22 @@
 WHENEVER SQLERROR EXIT SQL.SQLCODE
 
-CREATE TABLE dds_employees (
-  employee_id NUMBER PRIMARY KEY,
-  first_name  VARCHAR2(50) NOT NULL,
-  last_name   VARCHAR2(50) NOT NULL,
-  email       VARCHAR2(80) NOT NULL,
-  manager     VARCHAR2(80),
-  ssn         VARCHAR2(30),
-  salary      NUMBER(12,2),
-  phone       VARCHAR2(30)
-);
-
+BEGIN
+  EXECUTE IMMEDIATE q'[
+    CREATE TABLE dds_employees (
+      employee_id NUMBER PRIMARY KEY,
+      first_name  VARCHAR2(50) NOT NULL,
+      last_name   VARCHAR2(50) NOT NULL,
+      email       VARCHAR2(80) NOT NULL,
+      manager     VARCHAR2(80),
+      ssn         VARCHAR2(30),
+      salary      NUMBER(12,2),
+      phone       VARCHAR2(30)
+    )
+  ]';
+EXCEPTION
+  WHEN OTHERS THEN
+    IF SQLCODE != -955 THEN
+      RAISE;
+    END IF;
+END;
+/
diff --git a/scenarios/03-pii-row-column-cell/sql/01_seed_data.sql b/scenarios/03-pii-row-column-cell/sql/01_seed_data.sql
index 0edde0d..4858c88 100755
--- a/scenarios/03-pii-row-column-cell/sql/01_seed_data.sql
+++ b/scenarios/03-pii-row-column-cell/sql/01_seed_data.sql
@@ -1,5 +1,7 @@
 WHENEVER SQLERROR EXIT SQL.SQLCODE
 
+DELETE FROM dds_employees;
+
 INSERT INTO dds_employees VALUES (100, 'Victoria', 'Williams', 'victoria', NULL, '219-09-9999', 13000, '555-0100');
 INSERT INTO dds_employees VALUES (200, 'Marvin', 'Anderson', 'marvin', 'victoria', '457-55-5462', 12030, '555-0200');
 INSERT INTO dds_employees VALUES (300, 'Chris', 'Evans', 'chris', 'victoria', '321-12-4567', 6900, '555-0300');
@@ -7,4 +9,3 @@ INSERT INTO dds_employees VALUES (400, 'Emma', 'Baker', 'emma', 'marvin', '733-0
 INSERT INTO dds_employees VALUES (500, 'Taylor', 'Mills', 'taylor', 'marvin', '558-76-1243', 9000, '555-0500');
 
 COMMIT;
-
diff --git a/scenarios/03-pii-row-column-cell/sql/03_data_grants.sql b/scenarios/03-pii-row-column-cell/sql/03_data_grants.sql
index ee66615..f8f18f2 100755
--- a/scenarios/03-pii-row-column-cell/sql/03_data_grants.sql
+++ b/scenarios/03-pii-row-column-cell/sql/03_data_grants.sql
@@ -3,13 +3,13 @@ WHENEVER SQLERROR EXIT SQL.SQLCODE
 CREATE OR REPLACE DATA GRANT employees_own_record
   AS SELECT, UPDATE (phone)
   ON dds_employees
-  WHERE email = ORA_END_USER_CONTEXT.username
+  WHERE UPPER(email) = ORA_END_USER_CONTEXT.username
   TO employee_role;
 
 CREATE OR REPLACE DATA GRANT manager_direct_reports
   AS SELECT (ALL COLUMNS EXCEPT ssn), UPDATE (salary)
   ON dds_employees
-  WHERE manager = ORA_END_USER_CONTEXT.username
+  WHERE UPPER(manager) = ORA_END_USER_CONTEXT.username
   TO manager_role;
 
 CREATE OR REPLACE DATA GRANT hr_all_employees
diff --git a/scenarios/03-pii-row-column-cell/sql/04_test_queries.sql b/scenarios/03-pii-row-column-cell/sql/04_test_queries.sql
index a8d1cfb..6f06aec 100755
--- a/scenarios/03-pii-row-column-cell/sql/04_test_queries.sql
+++ b/scenarios/03-pii-row-column-cell/sql/04_test_queries.sql
@@ -6,9 +6,3 @@ ALTER SESSION SET CURRENT_SCHEMA = ADMIN;
 SELECT employee_id, first_name, last_name, email, manager, ssn, salary, phone
 FROM dds_employees
 ORDER BY employee_id;
-
-UPDATE dds_employees
-SET phone = '555-9999'
-WHERE email = ORA_END_USER_CONTEXT.username;
-
-COMMIT;
diff --git a/scenarios/03-pii-row-column-cell/sql/05_update_phone_test.sql b/scenarios/03-pii-row-column-cell/sql/05_update_phone_test.sql
new file mode 100644
index 0000000..6fe946b
--- /dev/null
+++ b/scenarios/03-pii-row-column-cell/sql/05_update_phone_test.sql
@@ -0,0 +1,17 @@
+SET PAGESIZE 100
+SET LINESIZE 200
+
+ALTER SESSION SET CURRENT_SCHEMA = ADMIN;
+
+PROMPT Employee self-service update: change own phone number.
+
+UPDATE dds_employees
+SET phone = '555-9999'
+WHERE UPPER(email) = ORA_END_USER_CONTEXT.username;
+
+COMMIT;
+
+SELECT employee_id, first_name, last_name, email, phone
+FROM dds_employees
+WHERE UPPER(email) = ORA_END_USER_CONTEXT.username
+ORDER BY employee_id;