Controls who can call it. - **Underlying table privileges** — The procedure's package runs with the authority of the package owner (via BIND PACKAGE with OWNER). Callers don't need direct SELECT/UPDATE on the underlying tables.