Multilevel security

Multilevel security is a security policy that allows you to classify objects and users based on a system of hierarchical security levels and a system of non-hierarchical security categories.

Multilevel security provides the capability to prevent unauthorized users from accessing information at a higher classification than their authorization, and prevents users from declassifying information.

Multilevel security offers the following advantages:

• Multilevel security enforcement is mandatory and automatic.
• Multilevel security can use methods that are difficult to express through traditional SQL views or queries.
• Multilevel security does not rely on special views or database variables to provide row-level security control.
• Multilevel security controls are consistent and integrated across the system, so that you can avoid defining users and authorizations more than once.
• Multilevel security does not allow users to declassify information.

Using multilevel security, you can define security for DB2® objects and perform other checks, including row-level security checks. Row-level security checks allow you to control which users have authorization to view, modify, or perform other actions on specific rows of data.

Multilevel security and row access control are mutually exclusive. While you can activate column access control on a table that has a security label column and enforce it on a security label column, you cannot do the same with row access control. If a table has a security label column, you cannot enable it with row access control. Vice versa is true; if a table is activated with row access control, you cannot alter it to include a security label column.