Any zone user with EXECUTE privilege on the DBC.AccLogRule macro can begin and end logging on objects within the zone, but not on objects outside their zone. Zone users cannot create an ON ALL log rule and they cannot end system-level logging rules that were created by non-zone users.
Users who have system-wide logging privileges can begin and end logging on all non-zone database objects. They cannot create log rules on zone database objects. They cannot end zone-level logging rules that zone users created. Users with system-wide logging privileges are the DBC user and any non-zone users, including zone guests, who have ZONE OVERRIDE privilege and EXECUTE privilege on the DBC.AccLogRule macro.