WHENEVER SQLERROR EXIT SQL.SQLCODE

CREATE OR REPLACE DATA GRANT employees_own_record
  AS SELECT, UPDATE (phone)
  ON dds_employees
  WHERE UPPER(email) = ORA_END_USER_CONTEXT.username
  TO employee_role;

CREATE OR REPLACE DATA GRANT manager_direct_reports
  AS SELECT (ALL COLUMNS EXCEPT ssn), UPDATE (salary)
  ON dds_employees
  WHERE UPPER(manager) = ORA_END_USER_CONTEXT.username
  TO manager_role;

CREATE OR REPLACE DATA GRANT hr_all_employees
  AS SELECT
  ON dds_employees
  TO hr_role;

BEGIN
  EXECUTE IMMEDIATE 'SET USE DATA GRANTS ONLY ON dds_employees ENABLED';
END;
/