Results for “grantee_key”

AI-generated from documented ETRM metadata — verify critical details on the linked pages.

Overview

FND_GRANTS is a core security and authorization table in the Oracle E-Business Suite FND (Application Object Library) product, residing in the APPLSYS schema. Each row represents a grant — an assertion that a specific grantee (a user or a group) holds permission to execute a menu, where a menu functions as a role composed of one or more functions. Every grant is scoped to a particular context, allowing the same role to be delegated differently depending on responsibility, security group, operating unit, or a defined instance of data. In this sense FND_GRANTS is the physical realization of the runtime authorization model that underpins the EBS Responsibility and Menu security architecture.

From a Data Vault modeling perspective, the mined foreign-key structure classifies FND_GRANTS as hub-leaning. This suggests treating the grant identity — anchored on GRANT_GUID — as a durable business hub, with the contextual and grantees attributes modeled as dependent links and satellites. The classification is heuristic and should be validated against actual ETL requirements.

Key Information Stored

The table is documented with 40 columns. The most significant of these are:

• GRANT_GUID — the globally unique identifier and the column forming the FND_GRANTS_PK1 primary key; this is the stable business identifier for a grant.
• GRANT_ID — a surrogate/alternate key indexed by the unique constraint FND_GRANTS_U1 (documented over GRANT_GUID and ZD_EDITION_NAME), used as the FK target by dependent tables.
• GRANTEE_TYPE and GRANTEE_KEY — indicate whether the recipient is a user or group and identify the specific grantee.
• MENU_ID — foreign key into FND_MENUS, referencing the role/menu being granted.
• START_DATE and END_DATE — the effective date range during which the grant is active, enabling time-bounded authorization.
• OBJECT_ID, INSTANCE_TYPE, INSTANCE_SET_ID, and INSTANCE_PK1_VALUE through INSTANCE_PK5_VALUE — define the context under which the grant applies, including the instance-level key of the object being secured.
• CTX_SECGRP_ID, CTX_RESP_ID, CTX_RESP_APPL_ID, and CTX_ORG_ID — the security group, responsibility, application, and organization context columns.
• GRANTEE_ORIG_SYSTEM and GRANTEE_ORIG_SYSTEM_ID — identify the source system of the grantee.
• PROGRAM_NAME, PROGRAM_TAG — audit the program that created or maintained the row.
• NAME and DESCRIPTION — human-readable identification of the grant.

Common Use Cases and Queries

FND_GRANTS is queried to answer authorization questions: which menus a user can execute, who holds a given role, and whether a grant is active on a given date. A typical pattern joins to FND_MENUS to resolve menu names:

• SELECT g.grant_guid, g.grantee_type, g.grantee_key, m.menu_name, g.start_date, g.end_date FROM fnd_grants g JOIN fnd_menus m ON g.menu_id = m.menu_id WHERE g.grantee_key = :user_name AND SYSDATE BETWEEN g.start_date AND NVL(g.end_date, SYSDATE + 1);
• Auditing expired or future-dated grants via START_DATE and END_DATE filters.
• Security review reports enumerating grantees by CTX_RESP_ID and CTX_ORG_ID to detect segregation-of-duties conflicts.
• Integration queries using GRANTEE_ORIG_SYSTEM and GRANTEE_ORIG_SYSTEM_ID to reconcile externally sourced identities.

Related Objects

• FND_MENUS — referenced by FND_GRANTS.MENU_ID; supplies the role definition behind each grant.
• PA_PROJECT_PARTIES — references FND_GRANTS via PA_PROJECT_PARTIES.GRANT_ID, linking project party records to their underlying grants.
• FND_GRANTS_PK1 / FND_GRANTS_U1 — the primary and unique indexes that enforce and support grant identity.

Additional dependent objects such as the FND security APIs and grantees resolution views build upon this table. Because FND_GRANTS is the hub-leaning authorization store, any custom security reporting should treat it as a primary source of truth for role-to-grantee assignments.