title: authorization filter in layered architecture
body: <p>Having a logical layered architecture means I have a layer with the only concern of updating or fetching data for the higher layers. Some of the queries from the consuming application have to return only the entities that the current user controlling the application has access to. For instance in an application for a user to manage computers, searching computers by name should only return matching computers that the user has access to obviously. Is it ok to put this filter, restricting the query to the ones the caller has access to, in this bottom data access layer or does this information have to be injected or passed down from upper layers? </p>
  
  <p>The thing that confuses me is that obviously fetching a lot of information just to throw it away later on its a waste of time but giving this layer this responsibility seems incorrect because I see it as a dumb IO layer (and this authorization like business logic that would prevent me from changing how it works in 1 place and it being transparent to all other components).</p>
  
  <p>How is this type of scenario usually handled both in theory and in practice?</p>