It seems to me that the *easiest* to start with would be role-based column filtering. There are no functions to grapple with, no dialect differences. You simply grab the list of columns that a given principal role has access to according to the FGAC policy attached to a given table.
--EM
