Restricting the scope of data access

A schema or a PCB defines a program's (and therefore the user's) view of the database. You can think of a schema as a mask that can be placed on top of the defined data structure of a database to hide certain parts of the data structure.

In Restricting processing authority, the top of the first figure shows the hierarchical structure for a PAYROLL database as seen by you in the definition of the database. For certain applications, it is not necessary (nor desirable) to access the SALARY segment. By omitting sensitivity to the SALARY segment from the DDL SCHEMA statement or PCB macro statement that defines the view of the database for the application, you can make it seem that this segment simply does not exist. By doing this, you have denied unauthorized users access to the segment, and you have denied users knowledge of its very existence.

For this method to be successful, the segment being masked off must not be in the search path of an accessed segment. If it is, then the application is made aware of at least the key of the segment to be hidden.

With field-level sensitivity, you can achieve the same masking effect at the field level. If SALARY and NAME were in the same segment, you could still restrict access to the SALARY field without denying access to other fields in the segment.