not to public.
if they need to run sp_Oa*, then only grant it to one specificl role or user/login that will actually need and use it.
depending on what they are actually doing, there probably exists a CLR stored procedure, already out there, to do the same work, but that would require them to change their code to use CLR instead of sp_OaCreate calls(leftover SQL2000 code?)
Lowell