Users share one application table but may see only their organization's rows. Which database control should be evaluated?

1. A UI-only filter with unrestricted direct SQL access
2. A nonclustered index alone
3. Row-level security with an appropriate predicate design
4. TDE as the row-authorization mechanism