1. A computer program product, tangibly embodied in a computer-readable storage medium, the computer program product being operable to cause data processing apparatus to perform operations comprising: receiving a search request; and searching a database data structure populated with records based on data from a plurality of database data structures, the records comprising data and criteria for authorization to access the data, the searching comprising: generating a set of results comprising data from the database data structure for which a user is authorized and omitting data from the database data structure for which the user is not authorized, the generating comprising using the criteria to determine which results to include in the set of results; and presenting the set of results to the user, the database data structure populated with records by: populating a column of the criteria to be used to determine whether the user is authorized to access a record based solely on the criteria and environment information, the environment information comprising user information, the populating the column comprising accessing two or more layers of associations in a table of business object node instances and the database data structures including authorization information to find the criteria to be used to determine whether the user has access to the record; wherein an authorization check is used to determine if the user is authorized to access the data from the database structure responsive to the search request, the authorization check applying a set of authorization rules; wherein the authorization rules are applied to a specific instance of a business object node and/or to a data model of business object nodes such that the authorization rules are applied to all instances of a business object node such that the authorization rules specify at least one authorization check that is required for each corresponding instance of the business object node.