Dropping security objects in RESTRICT mode or in CASCADE mode

By default, the RESTRICT keyword is in effect when any security object is dropped. Only a security policy can be dropped in CASCADE mode. DBSECADM cannot drop a security policy in RESTRICT mode if any of the following conditions are true:

• A table is protected by that security policy
• A security label depends on that security policy
• A user has been granted an exemption from a rule of that security policy.

A security policy cannot be dropped in CASCADE mode if the policy is protecting any table. When a security policy is successfully dropped in CASCADE mode, the following security objects are also dropped or revoked:

• All the security labels that are associated with the dropped security policy
• All the security labels that were dropped are also revoked from the users who hold those labels
• All the exemptions from the dropped security policy are revoked.

A security label cannot be dropped in RESTRICT mode, which is the only supported mode for dropping labels, if any of the following conditions are true:

• A column is protected by that security label
• A user holds that security label.