Moreover, you are usually assigned to a group of users who are allowed to execute some commands and not others, to modify some files and not some others, and who may even not be able to read some secure files. On some operating systems, some special characteristics may be assigned to your account, such as forcing the renewal of your password after a while, or forcing your deconnection after your spending too much time at the coffee-machine. Note that users need not having any special right on the temporary tablespace. Users can also be given tablespace quotas , which are the same as disk quotas, or in other words how much storage their tables and associated indexes can use in the named tablespaces. No quota means no right to create anything there.
Roles are the equivalent of user groups.
Do not use this too heavily, it quickly makes matters complicated and after a while you no longer know where the various privileges come from, which is not properly excellent for security. Avoid more than two levels. Nobody should ever connect as SYS , so set its password to something like hgqshdygthqshaez and that's it. The reason for this is that you will probably have to run, for maintenance reasons, DBA scripts started by the operating system task scheduler. With an externally identified account, you need not hard-code passwords in scripts.