security privilege from db