The business policy that gets defined for a user ultimately gets converted into a WHERE clause of the query and the actual query the gets executed has this WHERE clause.

Whats the confusion ?