In reply to jaap karman.

Jaap,

Yes, the documentation for the metadata-bound libraries makes it clear, I think -- this does not replace OS-based permissions for "tampering" with the data sets in the library. However, an unauthorized user cannot read the contents of the data, achieving the main goal of the feature. And SAS logging can alert you when a file has been tampered with.

SIEM is an interesting approach, but it also replicates the function provided by database systems that many of our customers use. I think it remains-to-be-seen what the demand is for a file-system-based level of control/monitoring that approaches the SIEM qualifications.