A method for providing secure views for shared data in a multi-tenant database, the method comprising: generating a share object in a first account, the share object comprising a share role; associating view privileges with one or more of a plurality of underlying details of the share object such that an underlying detail of the share object comprises a secure view definition; granting , to a second account, cross-account access rights to the share role or share object in the first account; receiving a request from the second account to access data or services of the first account; annotating query blocks of the request from the second account to designate the query blocks as coming from a secure view based on the secure view definition; based on the query blocks as being designated as coming from the secure view, generating a secure projection operator that behaves identically to a standard projection operator but which fails to match any rewrite rule preconditions of an optimization operation for a query plan tree of the query blocks; rewriting the query plan tree of the query blocks of the request by introducing the secure projection operator above a view's plan in the query plan tree and preventing expressions included in the query blocks of the request not stemming from the secure view from being pushed through the secure projection operator into the view's plan; and providing a response to the second account based on the accessed data or services of the first account; wherein the underlying detail of the share object comprising the secure view definition is hidden from the second account and visible to the first account. generating a share object in a first account, the share object comprising a share role; associating view privileges with one or more of a plurality of underlying details of the share object such that an underlying detail of the share object comprises a secure view definition; granting , to a second account, cross-account access rights to the share role or share object in the first account; receiving a request from the second account to access data or services of the first account; annotating query blocks of the request from the second account to designate the query blocks as coming from a secure view based on the secure view definition; based on the query blocks as being designated as coming from the secure view, generating a secure projection operator that behaves identically to a standard projection operator but which fails to match any rewrite rule preconditions of an optimization operation for a query plan tree of the query blocks; rewriting the query plan tree of the query blocks of the request by introducing the secure projection operator above a view's plan in the query plan tree and preventing expressions included in the query blocks of the request not stemming from the secure view from being pushed through the secure projection operator into the view's plan; and providing a response to the second account based on the accessed data or services of the first account; wherein the underlying detail of the share object comprising the secure view definition is hidden from the second account and visible to the first account. <EOS>