Implementing Report Data Security (MOAC and VPD)

For maximum flexibility and maintainability, the recommendation is to use the unrestricted base tables, such as `ap_invoices_all` (the `_all` tables), rather than relying on Oracle’s VPD-secured synonyms , . Security is then enforced by making the Operating Unit a required parameter in the Blitz Report . The List of Values (LOV) for this parameter is explicitly limited to include only the operating units accessible through the user’s current login responsibility and security profile .

The key advantage of using the required LOV parameter approach is enhanced flexibility . It allows your developers to test SQL queries directly using database tools without needing to initialize the full application user session context, which simplifies debugging . Furthermore, this method supports use cases like shared service centers, where a specific user might need elevated access to see all data across the system .

You can absolutely use Oracle Virtual Private Database (VPD) with Blitz Report to control access to sensitive data at the column or row level . VPD policies are set up on the database objects to automatically add restrictions before SQL execution . However, it is important to note that VPD policies implemented this way only secure data access through the Blitz Report concurrent program and not through direct access via database tools or standard Oracle EBS processes .

To secure data via VPD through Blitz Report, you must set up the specific tables or column names you wish to protect in the lookup `XXEN_REPORT_VPD_POLICY_TABLES` . You navigate to Application Developer > Application > Lookups > Application Object Library, query the lookup type, and enter a unique lookup code for each table or column, including the owner, table, and optional column name as the lookup meaning .

Yes, control over security features like Ledger and Operating Unit is managed through specific profile options , . The profile option ‘Blitz Report Use Ledger Security’ controls activation of ledger security . Many Cost Accounting (CAC) reports, for example, default to using only inventory organization security, but setting this profile to ‘Yes’ would enforce restriction by ledger access set . Conversely, setting it to ‘No’ (or its default value) would deactivate that layer of security.