Thank you. I am afraid that I cannot use the application side for this. Plus MS advertises RLS as easier to do than on the application side. I was looking at the decryptbykey, but that seems to be done at the field level. My need is to isolate all fields for the client in the Fact table, not only one.