Coursify

Virtual Private Database (VPD): Policy Functions, Predicates, and Secure Row Filtering

Virtual Private Database (VPD): Policy Functions, Predicates, and Secure Row Filtering

Verified Sources
Nov 4, 2026

The statement “allows a system administrator to associate a function with a relation; the function returns a predicate that must be added to any query that uses the relation” matches Virtual Private Database (VPD)—a feature (notably in Oracle Database) where a policy function generates a SQL predicate used to enforce fine-grained access control, effectively adding a filter condition to queries at runtime.

In VPD, you define:

  • a policy tied to a table (the “relation”),
  • a policy function that returns a predicate (e.g., a WHERE-clause fragment),
  • and the database automatically applies that predicate to qualifying SQL statements so users only see rows they’re authorized to access.2

Key terms in this section:

  • Virtual Private Database (VPD)
  • Policy function
  • Predicate
  • Fine-grained access control

Footnotes

  1. Virtual Private Database (VPD) - Oracle Help Center - Describes VPD concepts including policy functions returning predicates that are applied to statements using the protected object. ↩ ↩2

  2. Oracle Database Security Guide - Fine-Grained Access Control with VPD - Explains fine-grained access control concepts and how VPD enforces restrictions dynamically. ↩

Oracle Database VPD (Virtual Private Database) Overview

Why the other options don’t fit the definition

The phrasing specifically describes a database runtime query rewrite/filtering mechanism driven by a function returning a predicate. Among your choices, only VPD is designed around that pattern.2

  • OpenID: an authentication protocol for identity; it does not define per-row query predicates in relational databases.
  • Single-site system: too generic; not a standard security mechanism defined as “function returns a predicate added to queries.”
  • Security Assertion Markup Language (SAML): an XML-based standard for exchanging authentication/authorization assertions between parties; it does not operate at the level of dynamically restricting query results in a database relation.

Footnotes

  1. Virtual Private Database (VPD) - Oracle Help Center - Describes VPD concepts including policy functions returning predicates that are applied to statements using the protected object. ↩

  2. Oracle Database Security Guide - Fine-Grained Access Control with VPD - Explains fine-grained access control concepts and how VPD enforces restrictions dynamically. ↩

  3. OpenID - Wikipedia - General overview of OpenID as an authentication/identity system. ↩

  4. Security Assertion Markup Language (SAML) - Wikipedia - Overview of SAML as an XML-based assertion framework for authentication/authorization. ↩

How VPD enforces security (conceptual workflow)

  1. 1
    Step 1

    Create a VPD policy for a table/relation that identifies when it should apply (e.g., to SELECT/UPDATE/DELETE) and which policy function to use.

    Footnotes

    1. Virtual Private Database (VPD) - Oracle Help Center - Describes VPD concepts including policy functions returning predicates that are applied to statements using the protected object. ↩

  2. 2
    Step 2

    Write the function that inspects the current execution context (e.g., user/session attributes) and returns a predicate limiting accessible rows.2

    Footnotes

    1. Virtual Private Database (VPD) - Oracle Help Center - Describes VPD concepts including policy functions returning predicates that are applied to statements using the protected object. ↩

    2. Oracle Database Security Guide - Fine-Grained Access Control with VPD - Explains fine-grained access control concepts and how VPD enforces restrictions dynamically. ↩

  3. 3
    Step 3

    The application runs SQL that references the protected table (the relation).

  4. 4
    Step 4

    At runtime, the database invokes the policy function to compute the predicate for that user/session.

    Footnotes

    1. Virtual Private Database (VPD) - Oracle Help Center - Describes VPD concepts including policy functions returning predicates that are applied to statements using the protected object. ↩

  5. 5
    Step 5

    The database rewrites or augments the user’s SQL by injecting the returned predicate, ensuring the query only returns rows allowed by the policy.2

    Footnotes

    1. Virtual Private Database (VPD) - Oracle Help Center - Describes VPD concepts including policy functions returning predicates that are applied to statements using the protected object. ↩

    2. Oracle Database Security Guide - Fine-Grained Access Control with VPD - Explains fine-grained access control concepts and how VPD enforces restrictions dynamically. ↩

  6. 6
    Step 6

    The user receives a result set consistent with the predicate, achieving fine-grained row-level access control.

    Footnotes

    1. Oracle Database Security Guide - Fine-Grained Access Control with VPD - Explains fine-grained access control concepts and how VPD enforces restrictions dynamically. ↩

Mapping the prompt’s mechanism to the correct option

The prompt’s key requirement is predicate-returning function enforcement at query-time.

Pro Tip: Think in terms of query-time row filters

When you see wording like “predicate must be added to any query that uses the relation,” translate it to “the database automatically enforces row-level filters during SQL execution,” which is the core idea behind VPD.2

Footnotes

  1. Virtual Private Database (VPD) - Oracle Help Center - Describes VPD concepts including policy functions returning predicates that are applied to statements using the protected object. ↩

  2. Oracle Database Security Guide - Fine-Grained Access Control with VPD - Explains fine-grained access control concepts and how VPD enforces restrictions dynamically. ↩

Warning: Don’t confuse authentication standards with database authorization logic

OpenID and SAML are about exchanging identity/assertions—not dynamically appending predicates to SQL queries over database relations. If the question mentions functions, predicates, and relations, it’s describing a database fine-grained authorization feature like VPD.2

Footnotes

  1. OpenID - Wikipedia - General overview of OpenID as an authentication/identity system. ↩

  2. Security Assertion Markup Language (SAML) - Wikipedia - Overview of SAML as an XML-based assertion framework for authentication/authorization. ↩

Quick crosswalk of each option

Security enforcement lifecycle in a typical VPD flow

Administrator configures VPD

1) Policy setup

Associate a policy function with a relation and specify when it applies."

Footnotes

  1. Virtual Private Database (VPD) - Oracle Help Center - Describes VPD concepts including policy functions returning predicates that are applied to statements using the protected object. ↩

Policy function defines predicate rules

2) Function logic

Return a predicate derived from user/session attributes.2"

Footnotes

  1. Virtual Private Database (VPD) - Oracle Help Center - Describes VPD concepts including policy functions returning predicates that are applied to statements using the protected object. ↩

  2. Oracle Database Security Guide - Fine-Grained Access Control with VPD - Explains fine-grained access control concepts and how VPD enforces restrictions dynamically. ↩

Database evaluates policy at runtime

3) Query execution

Compute predicate and apply to the user query automatically."

Footnotes

  1. Virtual Private Database (VPD) - Oracle Help Center - Describes VPD concepts including policy functions returning predicates that are applied to statements using the protected object. ↩

Filtered results are returned

4) Outcome

Row-level access control is enforced transparently."

Footnotes

  1. Oracle Database Security Guide - Fine-Grained Access Control with VPD - Explains fine-grained access control concepts and how VPD enforces restrictions dynamically. ↩

Knowledge Check

Question 1 of 3
Q1Single choice

Which technology matches the statement: “allows a system administrator to associate a function with a relation; the function returns a predicate that must be added to any query that uses the relation”?

Explore Related Topics

1

SQL Command to Remove a Relation: Correct Choice and Conceptual Distinctions

2

Vector Databases

Vector databases store high‑dimensional embeddings and enable fast similarity search (e.g., nearest‑neighbor retrieval for a query q∈Rdq\in\mathbb{R}^d) instead of exact key lookups, powering RAG, semantic search, and recommendation systems.

  • Use Approximate Nearest Neighbor (ANN) indexes such as HNSW, IVF, and PQ to trade a small loss in recall for large gains in latency and scalability.
  • Combine vector search with metadata filtering, CRUD APIs, replication, and sharding to meet production AI requirements.
  • Retrieval pipelines ingest data, embed it, index vectors, encode queries, perform ANN search, apply filters, and optionally rerank results.
  • Choice of embedding model, distance metric (cosine, dot‑product, L2L_2), and index type determines recall‑latency‑memory trade‑offs.
  • Hybrid search (semantic + lexical) and reranking improve coverage and precision in RAG applications.
3

Purpose of Project (Projection) in Relational Algebra and Databases

Browse all research articles