WHENEVER SQLERROR EXIT SQL.SQLCODE

CREATE OR REPLACE DATA GRANT rag_public_internal_docs
  AS SELECT (chunk_id, document_title, department, classification, chunk_text, embedding)
  ON dds_rag_chunks
  WHERE classification IN ('PUBLIC', 'INTERNAL')
  TO rag_employee_role;

CREATE OR REPLACE DATA GRANT rag_hr_docs
  AS SELECT
  ON dds_rag_chunks
  WHERE classification IN ('PUBLIC', 'INTERNAL', 'HR_CONFIDENTIAL')
  TO rag_hr_role;

CREATE OR REPLACE DATA GRANT rag_legal_docs
  AS SELECT
  ON dds_rag_chunks
  WHERE classification IN ('PUBLIC', 'INTERNAL', 'LEGAL_CONFIDENTIAL')
  TO rag_legal_role;

CREATE OR REPLACE DATA GRANT rag_exec_docs
  AS SELECT
  ON dds_rag_chunks
  TO rag_exec_role;

SET USE DATA GRANTS ONLY ON dds_rag_chunks ENABLED;