Mandatory Access Control

Setup

staticMyDbContext(){//MAP PROPERTIES AS 'CLASSIFICATIONS'EntityAccessControl.RegisterPropertyAsAccessControlClassification((ArchiveEntitye)=>e.TenantName,"Tenant");EntityAccessControl.RegisterPropertyAsAccessControlClassification((DocumentEntitye)=>e.ConfidentialityLevel,"ConfLevel");//USE AMBIENT SCOPES (comming via CurrentSecurityToken) AS 'CLEARANCES'EntityAccessControl.ClearanceGetter=((scopeDimension)=>{if(scopeDimension=="Tenant")returnGetPermittedTenantsFromCurrentSecurityToken();if(scopeDimension=="ConfLevel")returnnewstring(){4,3,2};returnnewstring[]{};});}

Usage with EF

using(vardb=newMyDbContext()){DocumentEntity[]documentsAllowedToLoad=db.Documents.AccessScopeFiltered()//<< THIS COMES FROM US.Where((doc)=>doc.Name.Contains("Bar").ToArray();};

It is also evaluating the clearances for the Tenant-Field, located at the ArchiveEntity (which is the principal of the DocumentEntity), which were accessing!