A SELECT privilege answers whether a role can query an object. A masking policy controls the values a query returns. A row access policy decides which rows survive. These rules work together, so granting SELECT does not mean every reader sees the same result.
You define a policy with named arguments and a scalar expression, then attach it to the relevant columns. Test with the intended reader's role. Testing only as the owner can hide an error in the restricted branch. A secure view protects its definition from ordinary consumers and changes some optimization behavior; it does not automatically mask data or replace grants. This local account evaluates scalar policy expressions and role functions at query time. Mapping-table subqueries, policy administration privileges and optimizer privacy guarantees are outside the model. Use the exercises to verify returned values and row boundaries, rather than treating a successful attachment as proof.