I have a couple of VPD issues that I'm trying to ensure I fully understand based on reading Chapter 7 of Oracle Database 12c Security. I've seen both examples for well respected Oracle authors. Regarding bind variable reference of the SYS_CONTEXT function, I currently have the first of these cases in the policy function returned for the WHERE clause:

1. lvar_where_clause := 'activity_sa_id = ' || SYS_CONTEXT ('APP_USER_CTX', 'ACTIVITY');
produces:
WHERE (activity_sa_id = 8)

2. lvar_where_clause := 'activity_sa_id = SYS_CONTEXT (''APP_USER_CTX'', ''ACTIVITY'')';
produces:
WHERE (activity_sa_id = SYS_CONTEXT ('APP_USER_CTX', 'ACTIVITY'))

I see multiple cursors on the majority of application queries. I have 7 different activities in the system and this single policy is on 80% of the 1,500 tables. This has over 10 million hits per day and will probably hit 5-10 times that when the entire client base transition is complete. From the referenced chapter, #2 will allow binding and I should see more plan reuse.

This leads to the best choice for the VPD policy type. We're currently using DYNAMIC. I'm wondering why I can't/shouldn't be using SHARED_CONTEXT_SENSITIVE. A user can belong to multiple activities, but all applications force activity selection at startup for users with multiple assignments. They can also switch activities in a few of the stateless web apps, but it completely moves them into the selected activity and all SYS_CONTEXT parameters are reset. I have multiple technologies from COBOL, Forms, .Net, Cold Fusion, plus other client-server oddballs restricted by the VPD so any remote chance of bleed over cannot be tolerated. Is SHARED_CONTEXT_SENSITIVE with #2 WHERE clause the right path for such a session static parameter?