Clarification on STIG V-270523: Revoke WITH GRANT OPTION

Hello All,

I'm seeking clarification on STIG Group ID V-270523 for Oracle 19c (Release 1, dated 28 Jan 2025), which states:

"Revoke WITH GRANT OPTION to accounts that do not own application objects."
(STIG Reference – V-270523)
(Check Oracle 19c Database Security Technical Implementation Guide, Jan 2025 release)

In our environment, some web application accounts require the WITH GRANT OPTION privilege—for example, to support views that enforce row-level access or to manage custom role delegation. While I understand the underlying concern is about breaking privilege traceability and losing centralized control over object access, this pattern seems relatively common in application-layer security design.

My questions: