Access control for nested data fields

A system, comprising:

• one or more processors;
• and
• computer-readable storage device coupled to the one or more processors and having instructions stored thereon which, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
• intercepting a query submitted by a user device to a database, the query including a statement for accessing a data column of a table in the database;
• determining that the data column has a data type that defines a plurality of subfields of the data column;
• obtaining, from access control metadata, an access restriction on a subfield of the data column;
• modifying the query to provide a modified query that includes a reference to the subfield according to the access restriction;
• and
• submitting the modified query to the database.

A non-transitory storage device storing instructions that are operable, when executed by one or more computers, to cause the one or more computers to perform operations comprising:

• intercepting a query submitted by a user device to a database, the query including a statement for accessing a data column of a table in the database;
• determining that the data column has a data type that defines a plurality of subfields of the data column;
• obtaining, from access control metadata, an access restriction on a subfield of the data column;
• modifying the query to provide a modified query that includes a reference to the subfield according to the access restriction;
• and
• submitting the modified query to the database.