Chapter 5. Row-Level Security

Row-level security (RLS) allows you to define security policies on database tables (and specific types of operations on tables) that have the effect of restricting which rows a user can see or change in the tables. Introduced in Oracle8i Database, RLS has become a very helpful tool for DBAs, and the facility has been enhanced in the Oracle9i Database and Oracle Database 10g releases. The RLS functionality is implemented primarily through the Oracle built-in package nDBMS_RLS.

In this chapter, I'll describe how you can use DBMS_RLS to establish and use RLS policies for your database and how the RLS features available in Oracle9i Database compare with those available in Oracle Database 10g. I'll also describe how application contexts work in conjunction with RLS and how RLS interacts with a number of other Oracle features. Because most DBAs might still be running Oracle9i Database, this chapter starts with a description of that version's RLS functionality, most of which works the same way in Oracle Database 10g. Oracle Database 10g enhancements to RLS are described in the section "RLS in Oracle Database 10g." Before getting into the details of how RLS works, let's take a step back to look at the characteristics of database access and authorization.