Hi Angela,
Correct, Aras does not normally query the physical item tables directly when evaluating user access. Permission evaluation is pushed down to the database through SQL objects generated by Aras.
In environments using MAC policies, Aras generates secured database functions (for example secured.PART, secured.DOCUMENT, etc.) that combine the item data with the result of permission evaluation logic. These secured functions are evaluated for GET, DISCOVER, UPDATE and DELETE operations.
When Activating a MAC policy, you can observe that the secured function is getting updated with the MAC content.
I have implemented similar solutions where additional security constraints were injected into the database-layer filtering logic, but that was for standard Innovator ItemTypes and MAC policies rather than federation.
I'd also be interested to hear if anyone has successfully reused the standard Permission objects directly in a federated onGet implementation.
regards
Michael
