1. A computer-implemented method comprising: at a database server, receiving from a client a request for data that is stored at least in part in a particular column of a table in a database managed by the database server; wherein the database includes a security policy that is defined for the particular column of one or more particular rows stored in the table; at the database server, processing the request and retrieving a set of rows from the database, wherein each row of the set of rows includes the particular column of the table; after retrieving the set of rows and before sending a result set of rows to the client, at the database server modifying the set of rows into the result set of rows by applying the security policy to said each row of the set of rows, wherein applying the security policy to said each row comprises: determining whether the security policy is satisfied for the particular column of said each row; replacing, in the result set of rows, a data value in the particular column of said each row with a security-NULL value when the security policy is not satisfied for the particular column of said each row; and including the data value in the particular column of said each row into the result set of rows when the security policy is satisfied for the particular column of said each row; and after modifying the set of rows into the result set of rows, at the database server returning the result set of rows to the client.