9i and up they added the ability to tie packages to roles. so you can authenticate through a package, and not turn the role on if it fails. I'm having a brain fart and cannot remember what this feature is called. its part of the VPD. Someone here will remind us.... (please). -- http://www.freelists.org/webpage/oracle-l