For your enjoyment:
 
We've been directed to restrict programming staff's access to
production data to read-only if possible.  The only method which makes
sense to me - sure it's brute force, but it should work - is to create
a separate account for them and allow Read and Lock access to the
production accounts and selected groups within those accounts.  This
would allow them to open databases and files in shared- or
exclusive-read mode, but would prevent write-mode access.  ACD's are
also an option, but this can probably be done safely at the group
level.  Certain applications would not be available to them because the
opens are done in shared-write mode only, but this is not a serious
drawback as most support functions require access via other utilities.
 
Can anyone shoot holes in this scheme?  Please feel free to do so, but
only if you can offer a reasonable alternative!   :) :)     Thanks!!
 
Lee Gunter      503-375-4498        [log in to unmask]
HMO Oregon      503-375-4401  fax