I mentioned in the previous post that the 'security administrator' authority (SYSADM) no longer has ability to grant/revoke DBADM and SECADM. Only SECADM now has the ability to grant DBADM and SECADM. In fact, in 9.7 *only* SECADM can grant/revoke *all* database authorities.

A new 'access control' authority (ACCESSCTRL) is introduced in 9.7 which grants one the ability to grant/revoke *all* database authorities and *all* privileges on *all* objects! This new authority is implicitly included in the SECADM authority.