Separation of duties RDBMS performance data question

[CISSP_Candidate]

All,

Do you think allowing developers to see the performance data queried from a database (buffer pool hit ratios, memory utilization, etc) would break the "separation of duties" concept?

I have been trying to find some documentation about this, but haven't found anything so far...

Thank you

[Jescoi]

That's a very interesting question -- having been a performance analyst before becoming a security person.
Separation of duties ensures that one person cannot complete a risky task alone (paraphrase of AIO, p. 967).
While I have no intention of traveling down the mind-bending "statistical tracker" path of what a developer might deduce from the performance data regarding the actual contents of a database, that is a potential risk.
However, in general, I don't see a particular problem in the s-o-d area with allowing a developer read-only access to performance data on a RDBMS. Of more concern would be the possible necessity for them to be granted DBA authority in order to gather the information which would be a large s-o-d concern.