"CREATE DATABASE LINK" authorization

Dear Reader,

status: newbie; security planning

as in note 926023 :

"The "CREATE DATABASE LINK" authorization should be deactivated for database users and database roles that do not need this authorization."

on the other hand, the SAP PRESS Book:

SAP Database Administration with Oracle

recommends deactivating every account.

How do i secure that - in my case

DBA, RECOVERY_CATALOG_OWNER and IMP_FULL_DATABASE

do not need this authorization?

thanks in advance,