DML grants to PUBLIC

Hi-

This would be indeed a old topic, but I did not find any clear answer on this.

One of the IT users deleted all records from a table in Production. I could confirm he has RO privileges only.

But the hidden thing identified is that dba_rsrc_consumer_group_ privs has a default consumer group granted to PUBLIC and that user's login is using this group. And, the fact is that we have DML grants on that table given to PUBLIC. So I am thinking this is how we could have got the privilege to delete records.

Is there a way we can have another resource group assigned to user to prevent this? I do not want to remove grants from PUBLIC at this moment, as it may break anything in app.