this seems extremely inefficient.

attaching a role-based policy to data fields (or storing it alongside data) should be enough.