Dynamic RLS uses the signed-in identity to find permitted rows. USERPRINCIPALNAME returns that identity in the service. A mapping table can give one person one region and another person several. Filter the mapping to the current identity, then allow only the matching region values in Store.
Use test identities from the access data, not the author account by habit. An unknown identity should receive no rows. Two mappings for one user are legitimate when the person covers two regions; taking only the first match would silently remove access they need. The simulator supplies fictional access rows when you save this role, and View as accepts an Other user identity. Treat that preview as a test of the rule, not as a change to real workspace membership.