Access rules should outlive
your next reorganisation
Most access control is written in the vocabulary of the database rather than the vocabulary of the company, which is why it has to be rebuilt every time the company changes shape.
Two ways to write the same rule
One way: this group can select from these six tables, except these four columns, and there is a separate view for the regional managers.
The other way: a regional manager sees their own region, salary fields are visible to HR and to a person's own manager, and anything marked personal requires a named justification. The second version is longer in English and much shorter in maintenance, because it describes something that stays true when a table is renamed.
Why the first version keeps breaking
Table-shaped rules encode an implementation. Add a table, and somebody has to remember to add it to every group that should see it. Split a region, and a dozen grants need editing. Change the model, and the exceptions that accumulated around the old shape quietly stop meaning what they meant.
The exceptions are the real problem. Every one of them was reasonable when it was added, and none of them is documented well enough to remove with confidence, so they persist and widen.
Attributes instead of lists
When access is expressed against attributes, the rule is written once. A person's region comes from the directory. A row's region comes from the data. The rule says they must match, and it keeps working when a new region appears, a new table lands, or somebody moves teams.
The same applies to masking. A salary column is masked based on the relationship between the asker and the row, not on which of eleven views they happened to query.
Where this has to be enforced
None of it means anything if it only holds inside one tool. The rule has to apply to the dashboard, the ad hoc query, the export, the API and the agent, which means it has to sit under all of them rather than inside any one of them.
The practical test: can somebody get the unmasked value by using a different client? If yes, what you have is a convention, and conventions do not survive contact with a person in a hurry.