My idea is to create the possibility to authorize a role colum based from the Software Factory and I'll explain why.
For example there is al role to add and manage the employee data including sensitive data such as citizen service number (BSN). We also cretaed a role EMPLOYEE_read assigned to all employees as face book function in the system. In the GUI columns like BSN and partner data is hidden but a role will always have "No rights" or "Full read rights" on a table. The disadvantage is that users could read the table in its entirety from the SSMS.
The SF knows the column rights of a role (same as the GUI) so when the GRANT select on table will be expanded with the columns the database rights are always the same as the GUI rights.
