Can Oracle row-level security work with user session credentials?
From the documentation:


  Oracle database server provides a
  built-in application context namespace
  (USERENV) that provides access to
  predefined attributes. These
  attributes are session primitives,
  which is information that the database
  captures regarding a user session.
  Examples include the user name, the IP
  address from which the user connected,
  and a proxy user name if the user
  connection is proxied through a middle
  tier.
  
  Predefined attributes are useful for
  access control. For example, a
  three-tier application creating
  lightweight user sessions through OCI
  or thick JDBC can access the
  PROXY_USER attribute in USERENV.


So yes, if your middle tier is handling the proxy username correctly.