A system may include a database comprising stored data and a business process platform including business object metadata defining business objects representing the stored data. The business process platform may receive a query from a user to retrieve data from a first business object node of a business object, the business object representing stored data, determine whether the user is authorized to traverse all associations of a SELECT list of the query, determine whether the user is authorized to traverse all associations of a WHERE clause of the query, determine whether the user is authorized to retrieve any instances of each business object node of column specifications of the SELECT list of the query, and, if the determinations are affirmative, executing the query to retrieve a first result set.