I think you are suffering from a common miconception of Lob fields. Blob and Clob fields do not contain the data per say they just contain a LOB locator wich points to the data someplace else. (Not sure where actullay I think it differs from Oracle version to Version ) So if you want to update a lob you will first need the lob locator (select) then get the lob (select kind of) and then Update. At least that is what is going on behind the sceans in DBD::Oracle (OCI) If you want that sort of control over the user then wrap your insert in a procedure and then grant that use only use of that procedure. This would be the SQL work around for this. If you have Oracle 10.2 or greater and DBD 1.21 you can use prisistant lobs and bypass lob locators all together. you might want to they the lob read write and append functions as well but I think you need crud access to use them as well