Row level security - Test VAR table with ISEMPTY error

[Anonymous]

Background: Row-level security is required such that a null entry will return ALL values and non-null entries will return the specified values.

Examples:

1. User1 logs in and RLS filters data so that they can only see 'Sales' rows where [Manager Key] = 2

2. User2 logs in and RLS does not filter any data so can see all 'Sales' rows

Attempts and issue:

Below is my DAX formula attempt but I am running into an error "The expression specified in the query is not a valid table expression".

Does ISEMPTY not work with VAR tables?

EVALUATE

//vSMA returns a table that filters 'Security' to current user and non-blank entries
VAR vSMA =
    SELECTCOLUMNS (
        FILTER (
            'Security',
            'Security'[User Email] = USERPRINCIPALNAME ()
                && NOT ( ISBLANK ( 'Security'[Manager Key] ) )
        ),
        "Manager Key", [ Manager Key]
    )
RETURN
//return statement is attemtping to use logical test to say that if vSMA is empty (i.e. all entries are null) then return all manager keys, otherwise return those specified in 'Security' table

IF (
        ISEMPTY ( vSMA ),
        ALL ( 'Area'[Manager Key] ),
        vSMA
    )

Tables:

'Security' - contains [User Email] and [Manager Key]

User Email	Manager Key
user1@abc.com	2
user2@abc.com

'Area' - dimension table that contains [Manager Key] and other related fields

Manager Key	Region	Group
1	West	Retail
2	East	Retail
2	East	Retail

'Sales' - fact table that is connected to 'Area Manager' via [Manager Key]

[Mohammad_Refaei]

I have a similar business need where some users have to have restricted access while others should have unrestricted one. I handle this by creating 2 Roles, Restricted with the same role you designed. and Unrestricted without any filtration.

Just assign restricted users to the Restricted role in  your dataset while all others assign them to Unrestricted.

[Anonymous · Accepted solution]

Thanks for the input. I ended up creating a similar work-around though not using roles. It appears to me that currently DAX is unable to utilize logical operators on VAR tables or NULL returns. 
So instead of using the original solution (original post), I modified the 'Area' dimension table to have an [All Selected] column with a specific value assigned to indicate all selected. I then used an || operator to concatenate values that check each column.

This way, if user has the specific all value it will return all keys whereas if a user has any other value it will return only those. 

RETURN
CALCULATETABLE (
VALUES ( 'Area'[Manager Key] ),
'Area'[Manager Key] IN vSMA
|| 'Area'[Manager All] IN vSMA
)