how to extend a capability on a data source?

Good evening, all, I hope you are well,

If you have a big data source, like HBase, with over an exabyte going on, and the contents of a table, with column families (CF) and columns (C), have granular security requirements, how would you provide access in the form of a capability?  

For example, if you have a customer table, spread cross over 131 nodes, with a customer CF and an unencrypted customer profile C’U, as well as an encrypted profile C'E, the requirement to allow some people to decrypt the C’E, as well as impose a filter on the values found therein during scans, is a security situation.  How could such security filtering be perceived as a capability, without leakage and revocable and so on.  Furthermore, it would be efficient, I would think, if this capability filter be applied during access through the presentation layer, interleaved with HBase column scan processing.

Is there any research done in the area of capability access to a finely-grained, secure data-source?  Is it useful to somehow think of a capability as an execution barrier, “there is no bus”, as opposed to an ACL, which is “can I check your ticket, please”?  A capability on top of a data-source should be an opaque bus, where only certain seats are even visible, as you walk down the aisle, but there is no need to check the capability owner's ticket when she boards the bus.  During execution, any access is "checking the ticket" of every column value, within a row, so it’s an ACL, supporting all your profile management services.  It is like a dynamic view on the underlying data or something, I do not know.

thankyou for your thoughts,
rob