Enabling data security
Role-based security is not enough to develop a completely secure application because the role-based security is applied at the client side and it's very easy for anyone to change the role name in the browser console and view the restricted UI. So, along with role-based security, data security is also important. Data security restricts what a user can fetch from the backend APIs.
If data security is applied with role-based security, and if someone spoofs the role from the browser console, then the REST call will return an empty dataset. Data security is applied on the server side so that it is always secure.
For the custom Business Objects created inside VB, security can be applied at the Business Object level, but field-level security is not possible. For external REST APIs, no additional security can be applied in the VB application. You have to rely on external API security to secure the data fetched from external REST calls.
For demonstration...
