When using a direct share, what privileges does a role need to control access to the objects that are in a share that is using database roles? (Choose two.)