A method for database security, comprising: receiving, by a database security system, a request from a user associated with one or more user roles for access to a data record stored in a database table, the database table comprising encoded data records organized into columns, each encoded data record associated with a data record identifier and a column identifier; in response to a determination that a first subset of user roles mapped to the column identifier includes a first user role of the one or more user roles associated with the user, querying, by the database security system, a column identifier table to access one or more column protection schemes used to encode the requested data record; decoding, by the database security system, the requested data record using the accessed one or more column protection schemes to produce an intermediate encoded data record; in response to a determination that each of second user roles in a second subset of user roles mapped to the data record identifier is also included in the one or more user roles associated with the user, querying, by the database security system, a record identifier table to access one or more data record protection schemes used to encode the requested data record, decoding, by the database security system, the intermediate encoded data record using the accessed one or more data record protection schemes to produce a decoded data record, and outputting the decoded data record to the user; in response to determining, by the database security system, that the second subset of user roles mapped to the data record identifier includes a third user role not associated with the user, the third user role being associated with an additional protection scheme, decoding, by the database security system, a first portion of the intermediate encoded data record using one of the accessed one or more data record protection schemes associated with the second user roles to produce a partially decoded data record, a second portion of the intermediate encoded data record remaining encoded by the additional protection scheme, and outputting the partially decoded data record to the user. receiving, by a database security system, a request from a user associated with one or more user roles for access to a data record stored in a database table, the database table comprising encoded data records organized into columns, each encoded data record associated with a data record identifier and a column identifier; in response to a determination that a first subset of user roles mapped to the column identifier includes a first user role of the one or more user roles associated with the user, querying, by the database security system, a column identifier table to access one or more column protection schemes used to encode the requested data record; decoding, by the database security system, the requested data record using the accessed one or more column protection schemes to produce an intermediate encoded data record; in response to a determination that each of second user roles in a second subset of user roles mapped to the data record identifier is also included in the one or more user roles associated with the user, querying, by the database security system, a record identifier table to access one or more data record protection schemes used to encode the requested data record, decoding, by the database security system, the intermediate encoded data record using the accessed one or more data record protection schemes to produce a decoded data record, and outputting the decoded data record to the user; in response to determining, by the database security system, that the second subset of user roles mapped to the data record identifier includes a third user role not associated with the user, the third user role being associated with an additional protection scheme, decoding, by the database security system, a first portion of the intermediate encoded data record using one of the accessed one or more data record protection schemes associated with the second user roles to produce a partially decoded data record, a second portion of the intermediate encoded data record remaining encoded by the additional protection scheme, and outputting the partially decoded data record to the user.