FGAC/VPD可以从安全方面限制用户在行级别的访问权限，对于安全性考虑的应用有很大帮助。

另外，在一些特别特殊的情况下，可以通过它改写用户SQL的谓词（where condition）。

这里step by step做一个例子，以供以后参考。

SQL> show user
USER is "HAOZHU_USER"
SQL> create table testfgac as select * from dba_tables;

Table created.

1.建立一个context用来标示你希望标示的属性。

这里我用my_role来代表当前用户是否是我定义的“DB_OWNER”

SQL> create context hao_context using hao_package;

Context created.

SQL> create or replace procedure hao_package
( my_role in varchar2)
as
begin
    dbms_session.set_context (
            'HAO_CONTEXT',
            'MY_ROLE',
            my_role
    );
end;

Procedure created.

2.建立一个login trigger，如果当前用户是'HAO'，那么设立它的role是DB_OWNER.
SQL> create or replace trigger hao_ctx_trig
after logon on database
declare
   my_role varchar2(50);
begin
   select decode(sys_context('USERENV','SESSION_USER'),'HAO',
   'DB_OWNER','NOT_DB_OWNER')
   into my_role from dual;
   hao_package(my_role);
exception
   when NO_DATA_FOUND then
null;
   when OTHERS then
        raise;
end;

Trigger created.

3.查看login trigger生效没有
SQL>  show user
USER is "SYS"
SQL>  select sys_context('HAO_CONTEXT','MY_ROLE') myrole from dual;

MYROLE
--------------------
NOT_DB_OWNER

SQL> conn hao/hao
Connected.
SQL>  select sys_context('HAO_CONTEXT','MY_ROLE') myrole from dual;

MYROLE
--------------------
DB_OWNER

4.最重要的一步，建立一个function用来作为返回你想修改的谓词。
SQL>  create or replace function hao_secure
(my_owner in varchar2,
 my_obj in varchar2)
return varchar2
as
   ret varchar2(2000);
begin

select decode(sys_context('HAO_CONTEXT','MY_ROLE'),'DB_OWNER',null,'LAST_ANALYZED<=sysdate-1') into ret from dual;
   return ret;
end;

Function created.

5.加上policy,对dml语句和select都生效
SQL>  begin
   dbms_rls.add_policy (
OBJECT_SCHEMA => 'HAOZHU_USER',
object_name => 'TESTFGAC',
policy_name => 'my_p',
policy_function => 'HAO_SECURE',
statement_types => 'INSERT, UPDATE, DELETE, SELECT',
update_check    => TRUE
);
end;
/

PL/SQL procedure successfully completed.

6.测试
SQL> conn hao/hao
Connected.
SQL> select sys_context('HAO_CONTEXT','MY_ROLE') myrole from dual;

MYROLE
-------------------------

DB_OWNER

SQL> select count(*) from HAOZHU_USER.TESTFGAC;

  COUNT(*)
----------
      1043

SQL> conn another_user/another_user
Connected.
SQL> select count(*) from HAOZHU_USER.TESTFGAC;

  COUNT(*)
----------
       934