Oracle Virtual Private Database (VPD) enforces row-level filtering by attaching a policy function to a table, view, or synonym. When a user accesses that object, Oracle applies the predicate returned by the function, so applications do not have to repeat the same row filter in every query. That enforcement covers only the objects and statement types configured for the policy; it is not an unconditional guarantee against every access path.
What Oracle VPD does
VPD pairs a function that returns a SQL predicate with a policy that attaches the function to a database object. The function returns a VARCHAR2 expression that Oracle uses to restrict access to rows. In effect, Oracle incorporates that predicate into access to the protected object.
As an Amazon Associate I earn from qualifying purchases.
This puts the row-filtering rule in the database rather than relying on every application query to include it. The policy is still bounded: it applies to the object and statement types covered by its configuration, and its result depends on the predicate and trusted session context.
How a VPD policy is configured
Administrators manage VPD policies with DBMS_RLS. DBMS_RLS.ADD_POLICY attaches a policy function to an object and sets policy options, including statement coverage and, where needed, sensitive columns. Other package procedures can enable, alter, refresh, or drop policies; policy groups can organize multiple application policies.
#1 Best Overall
- Choose the protected object. Decide which table, view, or synonym needs row-level restrictions. Policy attachment is object-specific, so inventory the objects users can access.
- Define the predicate function. The PL/SQL function receives the schema and object name and returns the predicate Oracle should apply. Oracle documents this as a definer-rights function.
- Establish trusted session attributes. Use secure application context for attributes such as a user’s identity or tenant, and make sure the application establishes that context securely. A value supplied directly by a user is not, by itself, authenticated identity.
- Attach and scope the policy. Use
DBMS_RLS.ADD_POLICYto associate the function with the object and configure the statement types and any column behavior required. - Test the configured coverage. Verify access under relevant identities and for each operation the application performs. Review the policy against actual access paths and deployment privileges; do not infer coverage from a successful test of one query.
Oracle advises keeping the policy function pure: base it on application context and its arguments, not package variables, and do not query the protected table from the function that supplies its policy. Policy-function execution can consume significant resources, so the function’s work and invocation behavior matter operationally.
Which statements does VPD cover?
Oracle’s 19c documentation lists SELECT, INSERT, UPDATE, INDEX, and DELETE as statement types. The default configured coverage is SELECT, INSERT, UPDATE, and DELETE; it does not include INDEX. If index operations matter to the security design, assess them explicitly rather than assuming the default covers them.
For a policy with an explicit statement_types setting, Oracle says a MERGE policy needs all three of INSERT, UPDATE, and DELETE. Alternatively, the setting can be omitted. This is a release-specific configuration detail to verify against the documentation for the database release and service in use.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →These rules are why “you can’t route around it” is too broad as a security promise. VPD supplies database-side enforcement for configured access; it does not make an unprotected object or omitted statement type covered automatically. Audit both the policy attachment and statement scope, and evaluate privileged access and exemptions as part of the target deployment’s security review.
How application context affects per-user filtering
A policy function can tailor its returned predicate using secure application context, allowing the same policy to filter rows differently according to session attributes. For example, a design may use an authenticated identity or tenant attribute to determine which rows a session can see. The function’s predicate is only as trustworthy as the process that sets those attributes.
Keep authentication and context-setting in the trust boundary: the application must not let a user choose an arbitrary context value and treat it as proof of identity. Oracle’s guidance to use application context and function arguments, rather than package variables, also helps keep policy results tied to the intended session inputs.
Row filtering and column masking are different
| Mode | What the user receives | Important scope |
|---|---|---|
| Default column-level VPD | Rows are restricted when the specified sensitive column is referenced. | Column-sensitive policy behavior; distinguish it from filtering every row unconditionally. |
ALL_ROWS masking |
Rows are returned, but protected column values are displayed as NULL. |
Oracle documents this option as SELECT-only and requiring a simple Boolean condition. |
Masking is not equivalent to row-level filtering: the row remains present, while a value is replaced with NULL. Review application behavior and calculations that may be sensitive to NULL values, including displays and downstream logic.
Policy caching and performance trade-offs
Oracle’s Database 19c Security Guide describes five policy types. They differ in when Oracle reuses a predicate and how often it executes the policy function. The appropriate type depends on whether predicate results vary with session context and on the workload; caching should not be chosen without considering that variability.
Best Value
| Policy type | Reader’s decision point |
|---|---|
| Dynamic | Consider when the predicate needs to be generated dynamically rather than reused as a static result. |
| Static | Consider whether the predicate can be reused without varying by session context. |
| Shared static | Consider whether a static predicate can be shared across policies. |
| Context-sensitive | Consider when predicate validity depends on application context. |
| Shared context-sensitive | Consider context-sensitive behavior where predicate sharing is also relevant. |
The names indicate the broad caching dimensions, not a performance ranking. Oracle warns that policy-function execution can use significant resources, but the reviewed documentation provides no universal latency or throughput figure. Measure in the target workload and verify that reuse remains correct when relevant context changes.
Release, edition, and rollout checks
- Edition and service: Oracle’s 19c
DBMS_RLSreference says the package is available with Enterprise Edition only. Edition availability and licensing depend on the exact release and service; confirm them against the deployment and contract before making an architecture or purchasing decision. - Policy count: Oracle’s 19c Security Guide states a maximum of 255 policies per object.
- Dependent objects: Oracle warns that adding a policy can invalidate dependent objects and cause recompilation, which can affect performance. Plan policy changes as operational changes, not just security configuration.
- Release-specific behavior: The implementation details above primarily reflect Oracle Database 19c documentation. Check the documentation for the exact target release or service, especially for statement coverage and policy behavior.
Oracle’s stated direction in Database 26
Oracle’s Database 26 Security Guide says: “Oracle Deep Data Security extends and modernizes Oracle Virtual Private Database and Real Application Security, moving from earlier procedural PL/SQL and API-driven controls to declarative policies in SQL.” The same guide recommends Deep Data Security for identity propagation, database-enforced authorizations, and audit compliance. This is Oracle’s product-direction guidance; it does not establish that every VPD deployment must migrate or that the newer approach has identical features in every case.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errors
