WHENEVER SQLERROR EXIT SQL.SQLCODE

CREATE OR REPLACE DATA GRANT employees_own_record
  AS SELECT, UPDATE (phone)
  ON dds_employees
  WHERE email = ORA_END_USER_CONTEXT.username
  TO employee_role;

CREATE OR REPLACE DATA GRANT manager_direct_reports
  AS SELECT (ALL COLUMNS EXCEPT ssn), UPDATE (salary)
  ON dds_employees
  WHERE manager = ORA_END_USER_CONTEXT.username
  TO manager_role;

CREATE OR REPLACE DATA GRANT hr_all_employees
  AS SELECT
  ON dds_employees
  TO hr_role;

SET USE DATA GRANTS ONLY ON dds_employees ENABLED;