To enforce RLS with a dynamic rule that restricts access to sales regions per user, what should you create?

• A. Create an OLS role and use a dynamic rule.
• B. Create an RLS role and use a dynamic rule.
• C. Create an RLS role and use a static rule.
• D. Create an OLS role and use a static rule.

Answer: (B)

Row-Level Security lets you filter data rows based on who is querying. To enforce access that varies by user (restricting sales regions per user), you need a mechanism that adapts to the identity of the person asking. An RLS role provides the per-row filtering capability, and a dynamic rule makes that filter depend on the current user’s identity. In practice, the dynamic rule uses the user’s login (or a mapped attribute) to determine which regions are allowed and then only returns rows matching those regions. This per-user mapping is what enables true regional access control, rather than a one-size-fits-all filter.

Using an Object-Level Security role wouldn’t filter individual rows, only access to the object as a whole, so it wouldn’t enforce per-row regional restrictions. A static rule would apply the same filter to everyone, which fails to differentiate access by user. So combining a Row-Level Security role with a dynamic rule is the correct approach to achieve per-user region restrictions.