Dependent objects

A number of considerations must be determined to decide how to handle dependent objects of the permissions and masks.

Ownership
Dependent objects of a permission or mask should be owned by the user profile with the QIBM_DB_SECADM functional authority and no object management authority should be granted to other users.
Schema
All dependent tables or views of a permission or mask should be created in a different schema than the schema of the base table.
Schema authority
The schema that contains the dependent objects should not allow object management authority to users.
Secured UDFs
An SQL user-defined function (UDF) used in the RULETEXT of a permission or mask must be marked as SECURE.
ALWCPYDTA and isolation level
The expressions in the RULETEXT of the permission or mask runs with the same ALWCPYDTA and isolation level attributes when opening a base table, index, or view with an active permission or mask.
Restoring objects
Restoring a different version of a dependent object of the base table can impact the existing permissions and masks.

Parent topic: Best practices when using permissions and masks