Fine-grained access control (FGAC) in SQL is implemented using

Concept: Fine-grained access control (FGAC) restricts access to data at a granularity below the whole table or view - commonly at the level of individual rows, and sometimes columns - based on the context of the session issuing the query (such as the user's identity, role, or application context), rather than only at the level of the entire database object as the standard privilege system does.

Application: In SQL database engines this is implemented through virtual private databases (VPD) and security policies. A security policy may be a function registered through a package such as DBMS_RLS in Oracle, or a declarative row-security policy such as one defined with CREATE POLICY in PostgreSQL, associated with a table or view for one or more applicable statement types (for example SELECT, or separately for INSERT/UPDATE via a WITH CHECK expression). When an applicable statement is issued against that object, the engine evaluates the relevant policy and transparently incorporates the predicate it yields - as a row-visibility filter for reads or a write-time check for modifications - so the same statement can behave differently for different sessions without any change to the application's SQL.

Cross-check: Checking each distractor against its own actual function confirms none of them performs this row-level filtering:

• GRANT and REVOKE commands only - assign or withdraw object-level privileges (e.g. SELECT, UPDATE) on an entire table, view, or column set; they do not vary what a single privilege grants row by row.

• CHECK constraints - validate that a value being inserted or updated satisfies a condition; they enforce data integrity, not who may read or modify existing rows.

• Role-based table partitioning - divides a table's physical storage (by range, list, or hash) mainly for performance and manageability, and is not a security mechanism.

Result: Hence fine-grained access control in SQL is implemented using virtual private databases (VPD) and security policies.