Improve Deep Data Security lab scenarios

scenarios/01-ai-prompt-injection/sql/02_identities.sql

@@ -14,6 +14,14 @@ GRANT ai_prompt_session_role TO sales_rep_role;
 GRANT ai_prompt_session_role TO regional_manager_role;
 GRANT ai_prompt_session_role TO hr_global_role;
 
+-- Vulnerable baseline: this broad legacy role simulates an application or AI
+-- integration that grants direct object access before Deep Data Security is enforced.
+CREATE ROLE ai_prompt_legacy_access_role;
+GRANT SELECT ON dds_ai_customers TO ai_prompt_legacy_access_role;
+GRANT ai_prompt_legacy_access_role TO sales_rep_role;
+GRANT ai_prompt_legacy_access_role TO regional_manager_role;
+GRANT ai_prompt_legacy_access_role TO hr_global_role;
+
 GRANT DATA ROLE sales_rep_role TO alice;
 GRANT DATA ROLE regional_manager_role TO bruno;
 GRANT DATA ROLE hr_global_role TO carla;

scenarios/01-ai-prompt-injection/sql/03_data_grants.sql

@@ -3,7 +3,7 @@ WHENEVER SQLERROR EXIT SQL.SQLCODE
 CREATE OR REPLACE DATA GRANT ai_sales_rep_customers
   AS SELECT (customer_id, customer_name, region, account_owner, risk_rating)
   ON dds_ai_customers
-  WHERE account_owner = ORA_END_USER_CONTEXT.username
+  WHERE region = 'LATAM'
   TO sales_rep_role;
 
 CREATE OR REPLACE DATA GRANT ai_regional_manager_customers

scenarios/01-ai-prompt-injection/sql/99_reset.sql

@@ -20,6 +20,8 @@ BEGIN EXECUTE IMMEDIATE 'DROP DATA ROLE hr_global_role'; EXCEPTION WHEN OTHERS T
 /
 BEGIN EXECUTE IMMEDIATE 'DROP ROLE ai_prompt_session_role'; EXCEPTION WHEN OTHERS THEN NULL; END;
 /
+BEGIN EXECUTE IMMEDIATE 'DROP ROLE ai_prompt_legacy_access_role'; EXCEPTION WHEN OTHERS THEN NULL; END;
+/
 BEGIN EXECUTE IMMEDIATE 'DROP END USER alice'; EXCEPTION WHEN OTHERS THEN NULL; END;
 /
 BEGIN EXECUTE IMMEDIATE 'DROP END USER bruno'; EXCEPTION WHEN OTHERS THEN NULL; END;