title: How to implement database access control on row basis
body: <p>I'm currently developing a small business database application for which we plan to go towards multi-user access in the next time.</p>
  
  <p>The database mainly contains projects (in a project table) with a couple of joined tables containing additional information.</p>
  
  <p>One requirement of our customers regarding multi-user operations will be a fine-grained access control mainly based on project level (i.e. users only have access to some projects). I'm wondering how to implement this.</p>
  
  <p>What makes the situation a bit more difficult is that database access mainly happens in a self-developed persistence layer which construct the needed SQL queries (resembling to  nhibernate).</p>
  
  <p>The only solution I could come up with is to implement stored procedures (or views for read access?) inside the database which implement the access checks. Since our persistence layer currently relies on full access to tables this would mean to implement a read view, one insert and one delete command for each table and to change the persistence layer in order to use these commands (instead of constructing INSERT/DELETE queries). </p>
  
  <p>I'm wondering if there's any other solution not requiring to change our code...</p>