Effect of issuing a PREPARE statement or BIND with the EXPLAIN(ONLY) option when you have the EXPLAIN privilege

The EXPLAIN privilege allows you to prepare and describe SQL statements without having the privileges to execute those SQL statements.

When the RACF access control module is used for authorization checking, and you issue a PREPARE statement, Db2 first checks for the privilege to issue the statement on which the PREPARE is performed. If that privilege check fails, RACF issues message ICH408I. Then Db2 checks for the EXPLAIN privilege. If the EXPLAIN privilege check fails, RACF issues message ICH408I again. If the EXPLAIN privilege check succeeds, RACF does not issue an additional ICH408I message. The statement that Db2 prepares when you have only the EXPLAIN privilege cannot be executed. However, Db2 provides EXPLAIN information for the statement.

Similarly, when the RACF access control module is used for authorization checking, and you bind a package with the EXPLAIN(ONLY) option, Db2 first checks whether you have the privilege to execute the SQL statements in the package. If a privilege check fails, RACF issues unauthorized request message ICH408I. Then Db2 checks whether you have the EXPLAIN privilege. If the EXPLAIN privilege check fails, RACF issues message ICH408I again. If the EXPLAIN privilege check succeeds, BIND processing succeeds, and Db2 provides EXPLAIN information for the statements in the package.