1. A method of enforcing data privileges, comprising: receiving a query from a user to access a multi-tenant database; accessing a set of permissions specifying the user's data privileges to the multi-tenant database; identifying at least one object containing data matching the query in the multi-tenant database; authenticating the user's data privileges to the at least one object containing data matching the query via an authentication service independent of the multi-tenant database; and substituting a table-valued function for the at least one object based on the set of permissions.