Computer-implemented systems, methods, and computer program product for providing row-level security in a database network

1. A computer-implemented method for providing row-level security, comprising:

receiving, by one or more computer processors, a query from a user associated with an organization for data contained in a data table, wherein the data table contains one or more rows, wherein each row contains data, and wherein each row is associated with a person;

accessing, by the one or more computer processors, a multi-table data model including a non-security related query policy which guides and governs the query against data warehouses of the organization, wherein

the multi-table data model associates a row-level security policy with the data table,

the row-level security policy controls access permissions to the data table based on identity of the user and references a sparse hierarchical security table including a hierarchical structure of the organization,

the hierarchical structure identifies the user and any persons subordinate to the user in the organization, and

each row of the sparse hierarchical security table includes only direct relationships of the user to other persons in the hierarchical structure;

deriving a robust hierarchical security table from the sparse hierarchical security table when the multi-table data model is accessed, wherein each row of the robust hierarchical security table includes either direct or indirect relationships of the user to the other persons in the hierarchical structure;

using, by the one or more computer processors, the multi-table data model to augment the query to include a JOIN-based filter and a WHERE-based filter that includes the robust hierarchical security table having the hierarchical structure, wherein the augmented query complies with the non-security related query policy and references the robust hierarchical security table;

using, by the one or more computer processors, the augmented query to access one or more rows in the data table, wherein access to the one or more rows is dynamically filtered based upon the hierarchical structure contained in the robust hierarchical security table, wherein

the direct and indirect relationships are used to dynamically filter access to the one or more rows,

the dynamic filtering is done without additional traversal of the robust hierarchical security table to derive indirect relationships between the user and the persons subordinate to the user; and

providing, by the one or more computer processors, access to data contained in rows of the data table associated with the user and rows associated with the persons subordinate to the user.

2. The computer-implemented method of claim 1 , wherein each table contains one or more columns, and wherein the multi-table data model defines which of the one or more columns are used to join particular tables.

3. The computer-implemented method of claim 1 , wherein the multi-table data model further includes pre-defined filters.

4. The computer-implemented method of claim 1 , further comprising:

providing a graphical interface for defining the non-security related query policy, query guidance metadata, and the row-level security policy;

wherein the query guidance metadata provides guidance for creating the query.

5. The computer-implemented method of claim 1 , wherein the multi-table data model includes a second row-level security policy, wherein the second row-level security policy is selectively enabled by applying permission conditions within an authorization system.

6. The computer-implemented method of claim 1 , wherein the one or more rows accessed in the data table are provided to a query tool or a reporting tool.

7. The computer-implemented method of claim 1 , wherein the row-level security policy lists the data table as a data source.

8. The computer-implemented method of claim 1 , wherein the data contained in the data table includes employee information.

9. The computer-implemented method of claim 1 , wherein the data accessed in the rows of the data table are displayed in a report.

10. The computer-implemented method of claim 9 , wherein the report is provided to two different users, and wherein the data displayed for a first user is a subset of the data displayed for a second user based on the first user being subordinate to the second user.

11. A system for providing row-level security, comprising:

one or more computer processors;

one or more non-transitory computer-readable storage media containing instructions configured to cause the one or more computer processors to perform operations including:

receiving, by the one or more computer processors, a query from a user associated with an organization for data contained in a data table, wherein the data table contains one or more rows, wherein each row contains data, and wherein each row is associated with a person;

accessing, by the one or more computer processors, a multi-table data model including a non-security related query policy which guides and governs the query against data warehouses of the organization, wherein

the multi-table data model associates a row-level security policy with the data table,

the row-level security policy controls access permissions to the data table based on identity of the user and references a sparse hierarchical security table including a hierarchical structure of the organization,

the hierarchical structure identifies the user and any persons subordinate to the user in the organization, and

each row of the sparse hierarchical security table includes only direct relationships of the user to other persons in the hierarchical structure;

deriving a robust hierarchical security table from the sparse hierarchical security table when the multi-table data model is accessed, wherein each row of the robust hierarchical security table includes either direct or indirect relationships of the user to the other persons in the hierarchical structure;

using, by the one or more computer processors, the multi-table data model to augment the query to include a JOIN-based filter and a WHERE-based filter that includes the robust hierarchical security table having the hierarchical structure, wherein the augmented query complies with the non-security related query policy and references the robust hierarchical security table;

using, by the one or more computer processors, the augmented query to access one or more rows in the data table, wherein access to the one or more rows is dynamically filtered based upon the hierarchical structure contained in the robust hierarchical security table, wherein

the direct and indirect relationships are used to dynamically filter access to the one or more rows,

the dynamic filtering is done without additional traversal of the robust hierarchical security table to derive indirect relationships between the user and the persons subordinate to the user; and

providing, by the one or more computer processors, access to data contained in rows of the data table associated with the user and rows associated with the persons subordinate to the user.

12. A computer program product for providing row-level security, tangibly embodied in a non-transitory machine-readable storage medium, including instructions configured to cause a computer system to:

receive, by one or more computer processors, a query from a user associated with an organization for data contained in a data table, wherein the data table contains one or more rows, wherein each row contains data, and wherein each row is associated with a person;

access, by the one or more computer processors, a multi-table data model including a non-security related query policy which guides and governs the query against data warehouses of the organization, wherein

the multi-table data model associates a row-level security policy with the data table,

the row-level security policy controls access permissions to the data table based on identity of the user and references a sparse hierarchical security table including a hierarchical structure of the organization,

the hierarchical structure identifies the user and any persons subordinate to the user in the organization, and

each row of the sparse hierarchical security table includes only direct relationships of the user to other persons in the hierarchical structure;

derive a robust hierarchical security table from the sparse hierarchical security table when the multi-table data model is accessed, wherein each row of the robust hierarchical security table includes either direct or indirect relationships of the user to the other persons in the hierarchical structure;

use, by the one or more computer processors, the multi-table data model to augment the query to include a JOIN-based filter and a WHERE-based filter that includes the robust hierarchical security table having the hierarchical structure, wherein the augmented query complies with the non-security related query policy and references the robust hierarchical security table;

use, by the one or more computer processors, the augmented query to access one or more rows in the data table, wherein access to the one or more rows is dynamically filtered based upon the hierarchical structure contained in the robust hierarchical security table, wherein

the direct and indirect relationships are used to dynamically filter access to the one or more rows,

the dynamic filtering is done without additional traversal of the robust hierarchical security table to derive indirect relationships between the user and the persons subordinate to the user; and

provide, by the one or more computer processors, access to data contained in rows of the data table associated with the user and rows associated with the persons subordinate to the user.