Complex Dynamic Row Level Security

The implementation of RLS for ISV "app owns data" scenarios is truly awful. Using username as a dynamic can-be-anything string is nothing more than a hacky workaround for the fact that Embed has always been an afterthought.

For complex RLS scenarios the additional model bloating and maintenance required to translate complex permissions logic into table relationships is grotesque when the simple and obvious solution would be to allow the ISV to maintain the RLS logic outside the PBI and then pass an explicit set of filters in when getting the embed token. User filters would then apply 'within' the security filters set by the ISV application. Simple.