Consolidate data access control backoffice updates

sql/adb/41_dds_row_column_fixture.sql

@@ -0,0 +1,24 @@
+-- DDS row/column verification fixtures. Run as ADMIN after 31 and 34.
+CREATE TABLE admin.cb_dds_security_fixture (
+  fixture_id NUMBER PRIMARY KEY,
+  dept_code VARCHAR2(30) NOT NULL,
+  owner_emp_no VARCHAR2(30) NOT NULL,
+  tech_tag VARCHAR2(100) NOT NULL,
+  title VARCHAR2(200) NOT NULL,
+  contents VARCHAR2(2000) NOT NULL,
+  public_summary VARCHAR2(500) NOT NULL
+);
+
+INSERT INTO admin.cb_dds_security_fixture VALUES (1,'SALES','E2001','SALES','영업 파이프라인','영업 원문','영업 요약');
+INSERT INTO admin.cb_dds_security_fixture VALUES (2,'HR','E10234','HR','인사 운영','인사 원문','인사 요약');
+INSERT INTO admin.cb_dds_security_fixture VALUES (3,'FIN','E99999','FINANCE','재무 마감','재무 원문','재무 요약');
+COMMIT;
+
+CREATE OR REPLACE DATA GRANT admin.dds_demo_token_fixture_grant
+  AS SELECT (fixture_id, dept_code, owner_emp_no, tech_tag, title, public_summary)
+  ON admin.cb_dds_security_fixture
+  WHERE admin.cb_dds_vector_tag_allowed(tech_tag) = 1
+  TO cb_dds_token_role;
+
+-- Expected: token mapped to SALES sees row 1; HR/FIN rows are denied.
+-- CONTENTS is deliberately excluded: this is the column-level deny case.