Implementing column-level access policies

In row-level access policies, the policy is applied regardless of the selected columns.

However, when implementing restrictions at the column level, the policy is not enforced until the columns protected by the policy are included in the DML statement. As we will see, this option can also be used to mask column data when desired. When column masks are also enforced by the policy, the records that don't conform to the defined criteria have their column values hidden by the policy and displayed as nulls instead.

Getting ready

In this recipe we will create two users; DOCONNEL and JWHALEN. We will declare a policy named EMPLOYEES_SALCOMM_PLC that will protect the salary and commision_pct columns from the EMPLOYEES_TEST_VPD table. Then we will redefine the VPD policy to apply column masking.

How to do it...

1. As the system user create users DOCONNEL and JWHALEN:

   SQL> create user DOCONNEL identified by DOCONNEL;
   
   User created.
   
   SQL> create user JWHALEN...