We have something similiar in our shop and we set up a login trigger to kick the user out if they logginng in without using the application. If you go this way, then you would need to create a seperate user with different roles if they needed sqlplus access. -- //www.freelists.org/webpage/oracle-l