For the new ddl statement types, they are executed without checking authorizations. We have talked about several strategies including allowing vdb edit only if authorizing with an admin security domain.