Liquid syntax error: Unknown tag ‘endraw’

ORA-01031란?

ORA-01031: insufficient privileges 에러는 현재 데이터베이스 세션의 사용자가 요청한 작업을 수행하기 위한 권한이 충분하지 않을 때 발생하는 Oracle 에러입니다. 단순한 테이블 조회부터 DDL 실행, 시스템 관리 작업에 이르기까지 권한이 없는 모든 작업에서 발생할 수 있으며, 특히 운영 환경에서 계정 관리가 미흡할 때 자주 마주치는 에러입니다. 개발 초기에는 DBA 권한으로 작업하다가 운영 계정으로 전환하거나, 롤(Role) 기반 권한이 세션 컨텍스트에서 비활성화된 경우에도 동일한 에러가 발생할 수 있습니다.

주요 발생 원인

1. 객체에 대한 직접 권한 미부여
   특정 테이블, 뷰, 프로시저 등에 대해 SELECT, INSERT, UPDATE, DELETE, EXECUTE 등의 권한이 해당 사용자에게 직접 부여되지 않은 경우입니다. 특히 다른 스키마 소유의 객체에 접근할 때 자주 발생하며, 개발자가 자신의 스키마가 아닌 타 스키마 테이블에 쿼리를 날릴 때 흔히 겪는 상황입니다.

2. 롤(Role)을 통한 권한 부여 후 스토어드 프로그램에서 사용 시 충돌
   Oracle에서는 저장 프로시저(Stored Procedure), 함수(Function), 패키지(Package) 내부에서는 롤을 통해 부여된 권한이 적용되지 않습니다. 직접 권한(Direct Grant)만 인식하기 때문에, 롤로만 권한을 받은 사용자가 PL/SQL 블록 내에서 해당 객체에 접근하면 ORA-01031이 발생합니다.

3. 시스템 권한 미부여 (CREATE, ALTER, DROP 등)
   DDL 작업(테이블 생성, 인덱스 생성, 뷰 생성 등)을 수행하려면 해당 시스템 권한이 필요합니다. CREATE TABLE, CREATE VIEW, CREATE PROCEDURE 등의 권한 없이 DDL을 실행하면 이 에러가 발생하며, 특히 신규 계정 생성 직후 기본 권한만 부여된 상태에서 자주 발생합니다.

4. SYSDBA / SYSOPER 권한 없이 관리자 접속 시도
   CONNECT / AS SYSDBA 형태로 접속하려 할 때 해당 OS 사용자가 dba 그룹에 포함되어 있지 않거나, password file에 등록되지 않은 경우에 발생합니다. 원격 접속 시 password file이 존재하지 않아도 동일한 에러가 발생할 수 있습니다.

5. INVOKER RIGHTS vs DEFINER RIGHTS 혼동
   기본적으로 PL/SQL 객체는 DEFINER RIGHTS 방식으로 동작하여 소유자의 권한으로 실행됩니다. 그러나 AUTHID CURRENT_USER로 선언된 INVOKER RIGHTS 프로시저에서는 호출자의 권한을 기준으로 실행되므로, 호출자에게 권한이 없으면 ORA-01031이 발생합니다.

해결 방법

원인 1: 객체 권한 직접 부여

다른 스키마의 테이블이나 객체에 접근 권한을 부여합니다.

-- HR 스키마의 EMPLOYEES 테이블에 대해 APP_USER에게 SELECT 권한 부여
GRANT SELECT ON hr.employees TO app_user;

-- INSERT, UPDATE, DELETE 권한 함께 부여
GRANT SELECT, INSERT, UPDATE, DELETE ON hr.employees TO app_user;

-- 특정 컬럼에만 UPDATE 권한 부여 (컬럼 레벨 권한)
GRANT UPDATE (salary, job_id) ON hr.employees TO app_user;

-- 프로시저 실행 권한 부여
GRANT EXECUTE ON hr.process_employee TO app_user;

-- 권한 부여 후 확인
SELECT grantee, table_name, privilege, grantable
FROM dba_tab_privs
WHERE grantee = 'APP_USER'
ORDER BY table_name, privilege;

원인 2: PL/SQL 내 롤 권한 문제 해결

저장 프로그램 내부에서 롤로 부여된 권한은 동작하지 않으므로 직접 권한을 부여합니다.

-- 문제 상황: DEVELOPER_ROLE을 통해 권한을 받은 경우
-- PL/SQL 내부에서 hr.employees 접근 불가

-- 잘못된 방식 (롤을 통한 권한 - PL/SQL 내부에서 미동작)
GRANT SELECT ON hr.employees TO developer_role;
GRANT developer_role TO app_user;

-- 올바른 방식 (직접 권한 부여)
GRANT SELECT ON hr.employees TO app_user;

-- 현재 세션에서 활성화된 롤 확인
SELECT * FROM session_roles;

-- 사용자에게 직접 부여된 권한 확인
SELECT grantee, owner, table_name, privilege
FROM dba_tab_privs
WHERE grantee = 'APP_USER';

-- 롤을 통해 부여된 권한 확인 (PL/SQL 내에서는 미적용)
SELECT role, owner, table_name, privilege
FROM role_tab_privs
WHERE role IN (
    SELECT granted_role FROM dba_role_privs WHERE grantee = 'APP_USER'
);

원인 3: 시스템 권한 부여

DDL 실행에 필요한 시스템 권한을 부여합니다.

-- 기본 개발 계정 생성 및 권한 부여 예시
CREATE USER dev_user IDENTIFIED BY "SecurePass123!";

-- 접속 권한 부여
GRANT CREATE SESSION TO dev_user;

-- 객체 생성 관련 시스템 권한 부여
GRANT CREATE TABLE TO dev_user;
GRANT CREATE VIEW TO dev_user;
GRANT CREATE PROCEDURE TO dev_user;
GRANT CREATE SEQUENCE TO dev_user;
GRANT CREATE TRIGGER TO dev_user;
GRANT CREATE SYNONYM TO dev_user;

-- 테이블스페이스 쿼터 설정 (UNLIMITED 주의 - 운영환경에서는 제한 권장)
ALTER USER dev_user QUOTA 500M ON users;

-- 부여된 시스템 권한 전체 확인
SELECT grantee, privilege, admin_option
FROM dba_sys_privs
WHERE grantee = 'DEV_USER'
ORDER BY privilege;

-- 특정 권한 회수
REVOKE CREATE TABLE FROM dev_user;

원인 4: SYSDBA 접속 문제 해결

-- [OS 레벨] oracle 유저가 dba 그룹에 포함되어 있는지 확인 (Linux/Unix)
-- $ id oracle
-- uid=54321(oracle) gid=54321(oinstall) groups=54321(oinstall),54322(dba)

-- password file 존재 여부 확인 (Oracle 19c 기준)
-- $ORACLE_HOME/dbs/orapw{SID} 파일 존재 여부 확인

-- password file 재생성 (SYS 비밀번호 재설정)
-- $ orapwd file=$ORACLE_HOME/dbs/orapwORCL password=새비밀번호 entries=10

-- 원격 SYSDBA 접속 허용 여부 확인
SHOW PARAMETER REMOTE_LOGIN_PASSWORDFILE;

-- 필요 시 파라미터 변경 (EXCLUSIVE 또는 SHARED)
-- ALTER SYSTEM SET REMOTE_LOGIN_PASSWORDFILE=EXCLUSIVE SCOPE=SPFILE;

-- SYSDBA 권한을 가진 사용자 목록 확인
SELECT * FROM v$pwfile_users;

-- 특정 사용자에게 SYSDBA 권한 부여
GRANT SYSDBA TO dba_user;

원인 5: INVOKER RIGHTS 프로시저 권한 문제

-- INVOKER RIGHTS 프로시저 예시 (AUTHID CURRENT_USER)
CREATE OR REPLACE PROCEDURE get_employee_info(p_emp_id IN NUMBER)
AUTHID CURRENT_USER  -- 호출자 권한으로 실행
AS
    v_name VARCHAR2(100);
BEGIN
    -- 호출자에게 hr.employees SELECT 권한이 없으면 ORA-01031 발생
    SELECT first_name || ' ' || last_name
    INTO v_name
    FROM hr.employees
    WHERE employee_id = p_emp_id;

    DBMS_OUTPUT.PUT_LINE('직원명: ' || v_name);
END;
/

-- 해결책 1: 호출자에게 직접 권한 부여
GRANT SELECT ON hr.employees TO calling_user;

-- 해결책 2: DEFINER RIGHTS 방식으로 변경 (기본값)
CREATE OR REPLACE PROCEDURE get_employee_info(p_emp_id IN NUMBER)
-- AUTHID DEFINER (기본값, 생략 가능)
AS
    v_name VARCHAR2(100);
BEGIN
    SELECT first_name || ' ' || last_name
    INTO v_name
    FROM hr.employees
    WHERE employee_id = p_emp_id;

    DBMS_OUTPUT.PUT_LINE('직원명: ' || v_name);
END;
/

권한 문제 전반 진단 쿼리

sql
-- 특정 사용자의 모든 권한 현황 종합 조회
SELECT 'SYSTEM PRIVILEGE' AS priv_type,
       privilege AS privilege_name,
       NULL AS object_name,
       admin_option AS extra_option

Every few days, we see another discussion about AI replacing developers.

And honestly, after experimenting deeply with AI coding tools recently, I still don’t think developers are becoming irrelevant anytime soon.

Yes, AI is absolutely changing the game- Code generation is getting insanely fast ⚡, Boilerplate is becoming automated, Junior-level repetitive tasks are slowly getting replaced.

But at the same time, AI is creating a completely new skill domain:
debugging, reasoning, architecture thinking, and understanding systems deeply. 🧠

I realized this while experimenting with Google Antigravity today. I tried using its latest version to build an OpenCV-based project inspired by skribbl.io — essentially a multiplayer gesture-controlled drawing experience powered by computer vision.

And to be fair, the results were genuinely impressive. The UI structure, project flow, and a large portion of the logic were generated surprisingly well. You can clearly see how much engineering effort has gone into these systems.

But here’s the interesting part, even though the AI generated most of the structure, I still spent a huge amount of time:

• Debugging issues 🛠️
• Fixing gesture inconsistencies
• Testing real-world interactions
• Understanding why certain CV predictions were failing

And that’s where I think the real developer value still exists. Computer Vision, especially, exposed a major limitation in current AI coding systems 👁️‍🗨️

Generating code is one thing but understanding real-world spatial behavior, noisy camera input, gesture accuracy, latency handling, and contextual interactions is a completely different challenge.

The generated logic looked correct on paper — but practical implementation still required human intuition and experimentation.

That’s why I don’t think AI is “replacing” developers. I think it’s changing what being a developer actually means.

The developers who survive won’t just be people who can write syntax from memory. They’ll be the ones who can:

• Think critically
• Debug efficiently
• Understand systems deeply
• Experiment rapidly

Personally, I’m excited about that future 🚀✨

For now, I’ll keep experimenting with new AI tools, testing crazy ideas, learning emerging technologies, and slowly building toward my long-term goal: creating AI products that people can genuinely use in real life.

Would love to hear what others think:
Have AI tools improved your workflow — or just changed the type of work you do?

Your coding assistant is no longer just autocomplete with swagger; it is another production dependency.

The Weird Thing That Changed This Week

Most dev news is confetti with a changelog attached. This week was different.

On one side, OpenAI said an internal reasoning model disproved a longstanding conjecture in discrete geometry. Not “wrote a nicer regex.” Not “summarized a Jira ticket.” It produced work that external mathematicians checked.

On the other side, GitHub confirmed that roughly 3,800 internal repos were breached after an employee installed a malicious VS Code extension.

That is the whole developer moment in two tabs:

AI tools are getting frighteningly capable.

Developer workflows are getting hilariously porous.

The future is not “AI writes all the code.” The future is “AI can reason better than your Friday brain, while your editor extension can quietly steal the kingdom.”

Welcome to the new job.

The Tool Is Not The Workflow

A lot of teams are still treating AI coding tools like fancy autocomplete. Add the extension. Add the chat panel. Tell everyone to “use it responsibly.” Then wonder why the codebase feels like it got edited by five interns and a caffeinated spellchecker.

That model is dead.

The better framing is this: AI is now part of your software supply chain.

It reads code. It writes code. It suggests dependencies. It drafts tests. It explains failures. It may touch secrets, logs, architecture docs, stack traces, customer-shaped data, and everything else people paste when they are tired.

That means “which model should we use?” is only one small question. The bigger question is: what boundaries does this thing operate inside?

Because an assistant that can help solve hard problems can also help ship subtle nonsense at scale. And an extension that looks like productivity can become an incident report with syntax highlighting.

The Wrong Question Developers Ask

The wrong question is:

“Can AI do this task?”

That question is too easy now. For more and more tasks, the answer is “yes, kind of, depending on how much context and verification you give it.”

Can it write a migration? Sure.

Can it refactor a service? Often.

Can it debug CI? Sometimes faster than you.

Can it produce a convincing explanation for a bug it does not understand? Absolutely. It was born for that.

The dangerous part is not that AI fails. We already know software fails. The dangerous part is that AI fails with confidence, speed, and excellent formatting.

So the better question is:

“What system catches it when it is wrong?”

That is where real engineering starts.

The Better AI Workflow

Here is the boring, useful playbook. It will not trend as hard as “10 prompts that replaced my staff engineer,” but it will keep your repo breathing.

1. Give AI Smaller Blast Zones

Do not ask an assistant to “clean up the auth system” unless you enjoy archaeological debugging.

Give it narrow tasks:

• “Add validation for this input path.”
• “Write tests around this function before changing behavior.”
• “Explain why this query regressed.”
• “Refactor this file without changing public interfaces.”
• “Generate a migration and list rollback risks.”

Small tasks create reviewable diffs. Reviewable diffs create actual trust.

Big vague prompts create code fog.

2. Treat AI Output Like A Pull Request From A Stranger

Not an enemy. Not a genius. A stranger.

You would not merge a stranger’s PR because the comments sounded confident. You would check:

• Does the change match the existing design?
• Are the tests meaningful or just decorative?
• Did it introduce a dependency for a three-line helper?
• Did it change behavior outside the requested scope?
• Is the error handling real?
• Are edge cases named and covered?

The trick is to make this normal, not dramatic. AI code should go through the same path as human code: tests, review, observability, rollback plan when appropriate.

No special shrine. No special panic.

3. Lock Down The Editor Like It Matters

That GitHub incident is a reminder that the developer workstation is production-adjacent now.

If your editor can read private repos, tokens, env files, SSH configs, internal docs, and generated code, then editor extensions are not “personal preference.” They are executable supply-chain decisions.

Practical moves:

• Maintain an allowlist for extensions in company environments.
• Remove abandoned extensions from critical workflows.
• Prefer vendors with clear provenance and update history.
• Disable workspace trust bypasses.
• Keep secrets out of local files where possible.
• Rotate tokens when developer tooling gets weird, not three meetings later.
• Audit extensions that request broad filesystem or network access.

The edgiest thing your team can do in 2026 is basic hygiene.

4. Make The Compiler And CI Part Of The Conversation

One underrated trend: tooling is getting better at producing machine-readable feedback. GCC 16 work includes improved diagnostics and SARIF output, which fits a larger shift: compilers, linters, scanners, and CI systems are becoming structured signal feeds.

That matters because AI works better when it gets concrete feedback instead of vibes.

Bad loop:

“Fix the build.”

Better loop:

“Here is the failing test, compiler diagnostic, changed files, and expected behavior. Propose the smallest fix.”

Best loop:

AI proposes. Tools verify. Human reviews intent. CI blocks nonsense. The assistant gets the failure output and tries again inside a narrow scope.

That is not magic. That is a feedback system.

5. Stop Rewarding Prompt Theater

Contrarian take: prompt engineering is overrated inside mature engineering teams.

Not useless. Overrated.

The teams that win will not be the ones with the fanciest incantations. They will be the ones with clean interfaces, fast tests, readable errors, documented invariants, and boring automation.

AI loves a healthy codebase. It struggles in the same swamps humans do: hidden side effects, mystery globals, flaky tests, tribal deployment knowledge, and functions named handleThing2.

Want better AI output? Improve the terrain.

• Write smaller modules.
• Keep architectural decisions close to the code.
• Add examples to tests.
• Delete dead paths.
• Make local setup boring.
• Put invariants in types, schemas, and assertions.
• Make failure messages specific.

The prompt is not the product. The system is.

The New Senior Developer Skill

The senior move is no longer “I can personally hold the entire codebase in my head.”

That was always a cursed party trick.

The new senior move is designing workflows where humans and machines can both be useful without being trusted blindly.

That means knowing when to delegate to AI, when to pin it inside a sandbox, when to demand tests first, when to distrust a plausible answer, and when to turn the tool off and read the code like an adult.

AI is becoming a real collaborator. Great. Collaborators need boundaries.

Your editor is becoming a bigger attack surface. Fine. Attack surfaces need controls.

Your CI is becoming a negotiation partner. Excellent. Give it sharp teeth.

The Takeaway

This week did not say “developers are obsolete.”

It said the job is moving up a layer.

Less typing boilerplate. More designing guardrails. Less worshipping tools. More owning workflows. Less “can AI write code?” More “can our system survive code written at AI speed?”

Because the future belongs to teams that can move fast without letting every shiny extension hold the keys to the vault.

Time Blocking Templates for Different Work Styles

Originally published on Schedule Calendar Blog

Not all work schedules look the same. A time blocking template that works for a software engineer with long focus windows does not work for a manager with five calls before noon. Here are four templates adapted to different realities.

Why templates help

Starting a time blocking system from scratch means making dozens of small decisions each week: when do I block deep work, how long should each block be, where do I put email and admin, how do I handle the days that are mostly meetings?

A template provides a starting pattern — not a fixed rule, but a default structure to adapt. Most people modify their template significantly within a month, but having one at the start is faster than building from nothing.

Template 1: The maker schedule

Morning: 2–3 hour deep work block

This template works for roles with significant output work: engineers, writers, designers, researchers. The goal is a long morning block of uninterrupted focus, with all meetings and communication batched to the afternoon.

Midday: shallow work batch

A practical version: 8:00–10:30 deep work (Busy), 10:30–11:00 email/Slack batch, 11:00–12:00 meetings, 12:00–13:00 lunch, 13:00–17:00 available for meetings, with a 30-min wrap-up buffer at 16:30.

Afternoon: meetings only

The critical rule: the morning block is non-negotiable except for genuine emergencies. Everything else fits around it.

Template 2: The manager schedule

Morning: 1-on-1s and team syncs

Managers typically have less control over when meetings happen. This template accepts that reality and protects one reliable focus window rather than trying to minimize meetings.

Midday: a single focus block

A practical version: 9:00–12:00 available for team meetings (clustered), 12:00–13:30 protected focus block (Busy), 13:30–17:00 meetings and availability for decisions. The midday block is used for thinking that requires no interruption: planning, writing, reviewing strategy.

Afternoon: strategic decisions

The key: cluster meetings into the morning to create a predictable afternoon block that does not move.

Template 3: The remote worker

Morning: async communication catch-up

Remote work often means a mix of sync and async communication across time zones. This template front-loads async catch-up to clear communication overhead before the focus block begins.

Mid-morning: deep work block

A practical version: 8:00–9:00 async catch-up (email, Slack backlog, doc comments), 9:00–11:30 deep work block (Busy, notifications off), 11:30–12:30 lunch and light admin, 13:00–16:00 meetings and collaborative work.

Afternoon: availability window

The advantage: by 9am, the communication backlog is handled and the focus block starts with a clear head.

Key takeaways:

• Makers: protect a long morning block; cluster meetings in the afternoon.
• Managers: accept the meeting load, protect one midday focus block.
• Remote workers: clear async catch-up before the focus block begins.

Read the full guide on the Schedule Calendar blog — including a complete FAQ section, step-by-step examples, and how Schedule Calendar helps you put these habits into practice.

Add Schedule Calendar to Chrome — free