OLS and Framework pages

Question

Hi,
we're in the process of implementing OLS (Oracle Label Security) in our Financials environment, following the procedures documented in Metalink Note:234599.1 (Enabling Oracle Label Security in Oracle E-Business Suite).
All is working fine within Core Applications. We have a bespoke procedure, called from FND_INIT_SQL at site level, which sets the appropriate session label based on the user's responsibility, calling lbacsys.SA_SESSION.SET_ACCESS_PROFILE. The procedure also writes to a bespoke logging table so that we can see who is logged in, what their responsibility is, and what label gets set.
Whenever a user logs in to Core Apps, we can see that their session label is getting set appropriately, and they can only see those records which have the appropriate label setting. So far so good.
However, when the user switches to a Framework page, such as viewing notifications, although the logfile indicates that the session label is being set correctly, the user is now able to see all records, regardless of label.
The fact that the user is able to see all records indicates that the user must be logged in as APPS (as they are the only user who can see all records regardless of Responsibility), but the log would indicate that the session label has actually been set but is being ignored.
Anyone know what can be done to get OLS to work within Framework?
Thanks,
Ben
PS Apologies for cross-posting - have also posted this to the OA Framework discussion forum.

Answer 1

OK, we worked it out - thanks to all for your suggestions. Quick explanation.
Problem as we saw it:
We'd applied an OLS policy to the PO_REQUISITION_HEADERS_ALL table, but we were still able to see the details of these Requisitions through the Framework
notifications pages.
The real problem:
We'd applied the policy to PO_REQUISITION_HEADERS_ALL but not to PO_REQUISITION_LINES_ALL. Within the
application you can never view a Requisition Line without querying the
Requisition Header, so (for our testing purposes) we thought this it was enough
to only add security to the headers table.
However, the Framework pages are querying the Requisition Lines directly (the Requisition header ID is stored as
a workflow attribute) so it was effectively bypassing the security on the
headers table. Adding the policy to the lines table has fixed the table and we
can now only see those records we expect to see.
Hope this helps someone else out in the future.
Ben