Improve Deep Data Security lab scenarios

scenarios/05-legacy-app-ai-extension/sql/02_identities.sql

@@ -22,6 +22,17 @@ GRANT legacy_ai_session_role TO legacy_brazil_manager_role;
 GRANT legacy_ai_session_role TO legacy_support_role;
 GRANT legacy_ai_session_role TO legacy_legal_role;
 
+-- Vulnerable baseline: this broad legacy role simulates an AI agent attached to
+-- a legacy application that reuses direct table privileges before DDS is enforced.
+CREATE ROLE legacy_ai_broad_access_role;
+GRANT SELECT ON dds_legacy_customers TO legacy_ai_broad_access_role;
+GRANT SELECT ON dds_legacy_contracts TO legacy_ai_broad_access_role;
+GRANT SELECT ON dds_legacy_tickets TO legacy_ai_broad_access_role;
+GRANT legacy_ai_broad_access_role TO legacy_sales_rep_role;
+GRANT legacy_ai_broad_access_role TO legacy_brazil_manager_role;
+GRANT legacy_ai_broad_access_role TO legacy_support_role;
+GRANT legacy_ai_broad_access_role TO legacy_legal_role;
+
 GRANT DATA ROLE legacy_sales_rep_role TO joao;
 GRANT DATA ROLE legacy_brazil_manager_role TO ana;
 GRANT DATA ROLE legacy_support_role TO maria;

scenarios/05-legacy-app-ai-extension/sql/99_reset.sql

@@ -38,6 +38,8 @@ BEGIN EXECUTE IMMEDIATE 'DROP DATA ROLE legacy_legal_role'; EXCEPTION WHEN OTHER
 /
 BEGIN EXECUTE IMMEDIATE 'DROP ROLE legacy_ai_session_role'; EXCEPTION WHEN OTHERS THEN NULL; END;
 /
+BEGIN EXECUTE IMMEDIATE 'DROP ROLE legacy_ai_broad_access_role'; EXCEPTION WHEN OTHERS THEN NULL; END;
+/
 BEGIN EXECUTE IMMEDIATE 'DROP END USER joao'; EXCEPTION WHEN OTHERS THEN NULL; END;
 /
 BEGIN EXECUTE IMMEDIATE 'DROP END USER ana'; EXCEPTION WHEN OTHERS THEN NULL; END;