A database security system, comprising: a database table comprising encoded data records organized into columns, each data record associated with a data record identifier, a column identifier, and one or more data record categories; a column identifier table mapping each column identifier to one or more column protection schemes used to encode the corresponding data column and to one or more corresponding keys used by the one or more column protection schemes; a column role table mapping user roles to one or more column identifiers; a record identifier table mapping each data record identifier to one or more data record categories, one or more data record protection schemes used to encode the corresponding data record, and one or more corresponding keys used by the data record protection schemes to encode the data record; a record role table mapping user roles to one or more data record categories; an input configured to receive a request from a user associated with one or more user roles for access to a data record; a data protection engine comprising one or more hardware processors and configured to: in response to a determination that at least one of the one or more user roles are mapped by the column role table to the column identifier associated with the requested data record, query the column identifier table to access the column protection schemes and corresponding keys, and decode the requested data record using the accessed column protection schemes and corresponding keys to produce an intermediate encoded data record; and in response to a determination that each of the one or more data record categories mapped to the data record identifier associated with the requested data record by the record identifier table are also mapped to one of the one or more user roles, query the record identifier table to access the data record protection schemes and corresponding keys and decode the intermediate encoded data record using the accessed data record protection schemes and corresponding keys to produce a decoded data record; and an output configured to provide the decoded data record to the user. a database table comprising encoded data records organized into columns, each data record associated with a data record identifier, a column identifier, and one or more data record categories; a column identifier table mapping each column identifier to one or more column protection schemes used to encode the corresponding data column and to one or more corresponding keys used by the one or more column protection schemes; a column role table mapping user roles to one or more column identifiers; a record identifier table mapping each data record identifier to one or more data record categories, one or more data record protection schemes used to encode the corresponding data record, and one or more corresponding keys used by the data record protection schemes to encode the data record; a record role table mapping user roles to one or more data record categories; an input configured to receive a request from a user associated with one or more user roles for access to a data record; a data protection engine comprising one or more hardware processors and configured to: in response to a determination that at least one of the one or more user roles are mapped by the column role table to the column identifier associated with the requested data record, query the column identifier table to access the column protection schemes and corresponding keys, and decode the requested data record using the accessed column protection schemes and corresponding keys to produce an intermediate encoded data record; and in response to a determination that each of the one or more data record categories mapped to the data record identifier associated with the requested data record by the record identifier table are also mapped to one of the one or more user roles, query the record identifier table to access the data record protection schemes and corresponding keys and decode the intermediate encoded data record using the accessed data record protection schemes and corresponding keys to produce a decoded data record; and in response to a determination that at least one of the one or more user roles are mapped by the column role table to the column identifier associated with the requested data record, query the column identifier table to access the column protection schemes and corresponding keys, and decode the requested data record using the accessed column protection schemes and corresponding keys to produce an intermediate encoded data record; and in response to a determination that each of the one or more data record categories mapped to the data record identifier associated with the requested data record by the record identifier table are also mapped to one of the one or more user roles, query the record identifier table to access the data record protection schemes and corresponding keys and decode the intermediate encoded data record using the accessed data record protection schemes and corresponding keys to produce a decoded data record; and an output configured to provide the decoded data record to the user.