Forum Discussion
Row-Level Security (RLS) with INLINE or SCHEMABINDING
Yes — the function used for the RLS predicate should be INLINE.
That’s the expected type of function for RLS because it lets the engine fold the predicate directly into the query plan.SCHEMABINDING is just an additional option you apply on top of the inline function when you want stability and to prevent accidental schema changes.
So the correct combination is:
INLINE TVF → required
SCHEMABINDING → recommended/commonly used
Did I answer your question? Mark my post as a solution!
GopiKrishna
Hi tan_thiamhuat ,
Use SCHEMABINDING, compare the passed row value to the current user with USER_NAME(), and apply the policy to AuthorSales.
Short explanation : the table column (AuthorEmail) is passed into the inline TVF as @Author, the function checks it against the current principal (USER_NAME()), and SCHEMABINDING is recommended/required for stable RLS.
GopiKrishna
but isn't INLINE the recommended option for RLS because it integrates the predicate directly into the query execution plan, resulting in better performance? Microsoft documentation and best practices specifically recommend INLINE for RLS predicates.
Hi tan_thiamhuat ,
INLINE refers to the type of function used for the RLS predicate, and yes — RLS expects an inline TVF because it lets the optimizer fold the predicate directly into the query plan. That’s why you see INLINE called out as the recommended approach.
SCHEMABINDING is just an additional option you apply to the same inline function. It doesn’t replace INLINE or change how RLS works. It simply prevents underlying tables or columns from being altered in a way that might break the predicate later.
So in practice:
The predicate should be an inline TVF → this is the normal and recommended pattern for RLS.
SCHEMABINDING is added on top when you want stability and to avoid accidental schema changes.
That’s why examples often show both together: you still use INLINE for the function, and you also apply SCHEMABINDING as a safety measure.
GopiKrishna
so for the question above, we should put INLINE, correct?
Yes — the function used for the RLS predicate should be INLINE.
That’s the expected type of function for RLS because it lets the engine fold the predicate directly into the query plan.SCHEMABINDING is just an additional option you apply on top of the inline function when you want stability and to prevent accidental schema changes.
So the correct combination is:
INLINE TVF → required
SCHEMABINDING → recommended/commonly used
Did I answer your question? Mark my post as a solution!
GopiKrishna