Abstract: Herein are multitenant database security techniques for fine-grained and dynamic access control of protected resources according to phases and roles. In an embodiment, a computer associates a process with a particular pluggable database of many pluggable databases in a container database in a database management system (DBMS). From the process, a request is received to access a protected resource that the particular pluggable database does not contain. Based on the protected resource and the particular pluggable database, the DBMS dynamically decides, in response to receiving the request, whether to permit access to the protected resource. Based on authorization by the DBMS, the protected resource is accessed to fulfil the request. In an embodiment, centrally managed policy decisions for restricted access are dynamically employed across a fleet of databases through a global policy manager.