In reply to jaap karman.

Jaap, I agree with your points about using the DBMS and OS permissions as the first line approach to limit what end users can/should access. The SAS options like NOXCMD or LOCKDOWN do not grant privileges that end users don't already have, but they are simply an extra point of control that is specific to the SAS application. These options are something that admins have asked for to provide more flexibility, but they are not necessarily a best-practice approach to OS or data security.

In most cases, the SAS application runs as the user account, and is thus subject to the user's limitations on access and capability. SAS does nothing to override permissions that are set at the OS or data layer.