Hiding the Label

OLS provides the ability to hide the label column. Hiding the column means that the ROWLABEL column will not appear in a table DESCRIBE or a SELECT * query. Additionally, insert statements that insert data into all columns (for example, insert into <table> values ...) don’t need to specify the label column. You may recall that this column hiding was the behavior that Trusted Oracle exhibited.

Hiding the column can be desirable when you want to obscure the row-level security mechanism from users or applications. However, the user or application can always ask for the label column assuming they know the column name. OLS allows the column to be hidden, but not because it makes the data more secure. If your security is based on the users not knowing the column name, or security through obscurity, you have big challenges ahead of you! Hiding the column allows OLS to be transparently applied to tables with minimal impact on existing applications—those that issue SELECT * queries and insert all column statements. There also are many tools that model database tables. Hiding the label column is desirable for these tools because the label column shouldn’t appear in the table models.