C:\MIX\firebird\fb25>isql
Use CONNECT or CREATE DATABASE to specify a database
SQL> create database 't2.fdb'; commit;
SQL> create role norights_role;
SQL> create user norights_user password '123';
SQL> commit;
SQL> grant norights_role to norights_user;
SQL> commit;
SQL>  connect 't2.fdb' user norights_user role norights_role password '123'; 
Database:  't2.fdb', User: norights_user, Role: NORIGHTS_ROLE

SQL> set list on; -- проверим еще раз, что мы вошли как "бесправный юзер":
SQL> select current_user,current_role from rdb$database;

USER                            NORIGHTS_USER
ROLE                            NORIGHTS_ROLE


SQL> set list off;
SQL>  create table t(id int);  -- как ему запретить это делать ?
SQL> commit;
SQL> insert into t values(1);
SQL> commit;
SQL> select * from t;

          ID
============
           1

SQL> create view v_t as select * from t; commit;
SQL> create sequents gen_t; commit;
SQL> create sequence gen_t; commit;

SQL> show version;
ISQL Version: WI-V2.5.2.26520 Firebird 2.5
Server version:
Firebird/x86/Windows NT (access method), version "WI-V2.5.2.26520 Firebird 2.5"
Firebird/x86/Windows NT (remote server), version "WI-V2.5.2.26520 Firebird 2.5/XNet (CSPROG)/P12"
Firebird/x86/Windows NT (remote interface), version "WI-V2.5.2.26520 Firebird 2.5/XNet (CSPROG)/P12"
on disk structure version 11.2

SQL> commit;
SQL> create role norights_role; -- её надо снова создать, т.к. роли хранятся в базе, а не в sec2.fdb
SQL> grant norights_role to norights_user;
SQL> commit;
SQL> connect 't2.fdb' user norights_user role norights_role password '123';
Database:  't2.fdb', User: norights_user, Role: NORIGHTS_ROLE
SQL> set list on;
SQL> select current_user,current_role from rdb$database;

USER                            NORIGHTS_USER
ROLE                            NORIGHTS_ROLE


SQL> set list off;
SQL> create table t(id int);  -- прокатило! why ?? 
SQL> commit;

C:\MIX\firebird\fb25>isql
Use CONNECT or CREATE DATABASE to specify a database
SQL> create database 't2.fdb'; commit;

grant all on rdb$character_sets to sysdba;
grant all on rdb$check_constraints to sysdba;
grant all on rdb$collations to sysdba;
grant all on rdb$database to sysdba;
grant all on rdb$dependencies to sysdba;
grant all on rdb$exceptions to sysdba;
grant all on rdb$field_dimensions to sysdba;
grant all on rdb$fields to sysdba;
grant all on rdb$files to sysdba;
grant all on rdb$filters to sysdba;
grant all on rdb$formats to sysdba;
grant all on rdb$function_arguments to sysdba;
grant all on rdb$functions to sysdba;
grant all on rdb$generators to sysdba;
grant all on rdb$index_segments to sysdba;
grant all on rdb$indices to sysdba;
grant all on rdb$log_files to sysdba;
grant all on rdb$pages to sysdba;
grant all on rdb$procedure_parameters to sysdba;
grant all on rdb$procedures to sysdba;
grant all on rdb$ref_constraints to sysdba;
grant all on rdb$relation_constraints to sysdba;
grant all on rdb$relation_fields to sysdba;
grant all on rdb$relations to sysdba;
grant all on rdb$security_classes to sysdba;
grant all on rdb$transactions to sysdba;
grant all on rdb$trigger_messages to sysdba;
grant all on rdb$triggers to sysdba;
grant all on rdb$types to sysdba;
grant all on rdb$user_privileges to sysdba;
grant all on rdb$view_relations to sysdba; 
commit;
--------------------------------------------
set warnings off;
--  revokes  all from PUBLIC role:
revoke all on rdb$character_sets from public;
revoke all on rdb$check_constraints from public;
revoke all on rdb$collations from public;
revoke all on rdb$database from public;
revoke all on rdb$dependencies from public;
revoke all on rdb$exceptions from public;
revoke all on rdb$field_dimensions from public;
revoke all on rdb$fields from public;
revoke all on rdb$files from public;
revoke all on rdb$filters from public;
revoke all on rdb$formats from public;
revoke all on rdb$function_arguments from public;
revoke all on rdb$functions from public;
revoke all on rdb$generators from public;
revoke all on rdb$index_segments from public;
revoke all on rdb$indices from public;
revoke all on rdb$log_files from public;
revoke all on rdb$pages from public;
revoke all on rdb$procedure_parameters from public;
revoke all on rdb$procedures from public;
revoke all on rdb$ref_constraints from public;
revoke all on rdb$relation_constraints from public;
revoke all on rdb$relation_fields from public;
revoke all on rdb$relations from public;
revoke all on rdb$security_classes from public;
revoke all on rdb$transactions from public;
revoke all on rdb$trigger_messages from public;
revoke all on rdb$triggers from public;
revoke all on rdb$types from public;
revoke all on rdb$user_privileges from public;
revoke all on rdb$view_relations from public; 
set warnings on;
commit;
-----------------------
grant select on rdb$character_sets to public;
grant select on rdb$check_constraints to public;
grant select on rdb$collations to public;
grant select on rdb$database to public;
grant select on rdb$dependencies to public;
grant select on rdb$exceptions to public;
grant select on rdb$field_dimensions to public;
grant select on rdb$fields to public;
grant select on rdb$files to public;
grant select on rdb$filters to public;
grant select on rdb$formats to public;
grant select on rdb$function_arguments to public;
grant select on rdb$functions to public;
grant select on rdb$generators to public;
grant select on rdb$index_segments to public;
grant select on rdb$indices to public;
grant select on rdb$log_files to public;
grant select on rdb$pages to public;
grant select on rdb$procedure_parameters to public;
grant select on rdb$procedures to public;
grant select on rdb$ref_constraints to public;
grant select on rdb$relation_constraints to public;
grant select on rdb$relation_fields to public;
grant select on rdb$relations to public;
grant select on rdb$security_classes to public;
grant select on rdb$transactions to public;
grant select on rdb$trigger_messages to public;
grant select on rdb$triggers to public;
grant select on rdb$types to public;
grant select on rdb$user_privileges to public;
grant select on rdb$view_relations to public; 
commit;

create role norights_role;
commit;
grant norights_role to norights_user;
commit;
connect 't2.fdb' user norights_user role norights_role password '123';
set list on;
select current_user,current_role from rdb$database;
set list off;
show roles;
commit;

Database:  't2.fdb', User: norights_user, Role: NORIGHTS_ROLE

USER                            NORIGHTS_USER
ROLE                            NORIGHTS_ROLE


       NORIGHTS_ROLE

SQL> create table t(id int);
SQL> commit;
SQL> drop table t;
SQL> commit;
SQL> create table t(b blob);  commit;
SQL> insert into t select list(gen_uuid()) from rdb$fields,rdb$fields,rdb$fields; commit;