You cannot filter on the AD group.
This previous question explains how the access management works with AD groups:
How to tell which windows group login I used when logging in via windows authentication
I would use regex_like:
when regexp_like(' '||column_value||' ','\s(drop|execute|truncate|create|insert|update|delete|merge)\s', 'i')
end as illegal
('drop table customers', 'just dropping by', 'undroppable'));
I'm not sure there is a good answer. In general, string concatenation to build your SQL is always a bad idea and should be avoided whenever possible. That said, it would be difficult to avoid in your case except for replacing user_id references with bind variables. Other than that, you will have to come up with some custom logic to validate the content of ...