Abstract: One embodiment of the present invention provides a method for managing security in a database system. The method includes producing a plurality of task groups, the task groups including actions that may be performed on the database. Functional roles are created from these task groups, and a security profile for a user is created by assigning to the user at least one functional role. In one embodiment, the security profile for a user may only be created by assigning functional roles to users. Thus, users may only perform actions on the database that are dictated by defined task groups and functional roles. This allows database security to be controlled by controlling definitions of task groups and functional roles, without requiring exhaustive examination of security profiles for large numbers of individual users.