Setting Up with the %READERLIST Field

For a given table, to enable row-level security using the %READERLIST field, make the following changes to the class from which the table is projected.

In the class definition, set the value of the ROWLEVELSECURITY parameter:
```
Parameter ROWLEVELSECURITY = 1;
```
In this case, once you compile the class, the %RLI index is automatically added to the class, although it is not visible in the class definition. This is a a collection index on the %READERLIST property. The query optimizer uses it to minimize the performance impact when row-level security is enabled.
If you want to store the values in another property in the same class, then set the parameter equal to the name of that property.
```
Parameter ROWLEVELSECURITY = "rlsprop";
```
Where rlsprop is the name of a property in the same class.
If you used a custom property name (that is, ROWLEVELSECURITY is not 1), add an index named %RLI index on the property.
If you expect to never have more than one username or role in this property, then this index can be an ordinary (non-collection) bitmap index. This generally provides optimal performance.
In the same class, also define a %SecurityPolicy() class method, which specifies the role and usernames that are permitted to select the row, subject to view and table SELECT privileges.
This class method must return an empty string, a username, a role, or a comma-separated list of usernames or roles. If the method returns an empty string, there is no specific restriction for this row; the row is visible to all users who hold the SELECT privilege on the table.

Important:

The %All role does not automatically have access to rows in a table that are protected with row-level security. If %All is to have access to such a row, the %SecurityPolicy() method must explicitly return the %All role, along with others as needed.

The structure of the %SecurityPolicy() method is:
```
ClassMethod %SecurityPolicy() As %String [ SqlProc ]
{
    RETURN ""
}
```
Its characteristics are:
- It is a class method with the required name %SecurityPolicy.
- It returns a string (type %String).
- It takes zero or more arguments. If this method takes any arguments, each argument name must match a property name in the class. If any property names do not exactly match their SQL field names, instead use the SQL field names as argument names.
- The SqlProc keyword specifies that the method can be invoked as a stored procedure.
Compile the class and any dependent classes.

When you compile this class, two changes are made to it automatically (but are not visible in the class definition):

It has a new property named %READERLIST, which is a calculated field. The value of this field is determined by the %SecurityPolicy() method. Whenever an INSERT or UPDATE occurs, %SecurityPolicy() is invoked for that row and populates the value of %READERLIST.
It has an index named %RLI index, which is a collection index on the %READERLIST property.

Setting Up with a Custom Field

Introduction