Row-Level Security

Mirrors the in-app Help. The live copy in your console and `dlake guide help` are always current.

SQL Server RLS via security policies + predicate functions reading SESSION_CONTEXT keys (sub, email, domain, sql_identifier, api_key_id, is_owner) — set automatically by DAB on every request and mirrored by the DDL API on all bulk read paths (exports, aggregate, data-viewer paging, change tracking, events). Build policies on the RLS page: pick a table, write/choose a predicate function, enable. A predicate that works under DAB behaves identically everywhere. Events are RLS-filtered per consumer (see Events).