I would like to understand if there's a good case for using metadata bound libraries in general and the following set-up in particular:   SAS 9.4 on a Linux server Access to the server only through EG and SAS Studio No shell or XCMD access for users Data is primarily sorted on a database server, users will take cuts of data and store on SAS server for further analysis Users are organized in relatively large number of groups that work on one or more projects. Few users are in more than one group A group should not have access to other groups' SAS data and analysis output. Without metadata bound libraries (MLB), (almost) all we have to do is Provision users in SAS and on Linux Provision Linux groups and populate with users Create respective data and output folders on the Linux for each group with appropriate permissions In this case, the users of each group can create folders to organize their data sets and results however they wish. Essentially the SAS server storage space is used similar to a file system with only file system security in place.   With MLB, the following needs to be done: Provision users in SAS and on Linux Provision Linux groups and populate with users Create respective data and output folders on the Linux for each group with appropriate permissions Create SAS groups and populate with users Create SAS metadata folders and secure them based on the SAS groups Create SAS Secured Libraries with encryption Provision secured libraries to each group with appropriate permissions (create table, etc) Create and assign libraries that correspond to the secured libraries Do some magic with symbolic links so that users are not able to navigate the data folder, and not able to create sub-folders there, essentially preventing them to store data unencrypted Monitor the output folders to make sure SAS data files are not stored there In this case, users are not able to freely organize their data tables in folders, they only have a library to store their data. This means they have to adopt naming convention for their tables in the library and be extra careful not to overwrite each others tables. Essentially, the SAS server storage is used similar to a database schema. Administrators still need to monitor output folders to make sure data files are not stored there unencrypted. I understand the additional benefit of encryption at rest, but this seems to protect the data mainly from storage administrators. In case the SAS server is compromised, I don't think MLB provides any additional benefits as the encryption keys are maintained in metadata and someone who has come this far to gain access to the server, probably could figure out how to unencrypt the data as well.    Maybe I am missing the point of MLB. What do you think? Thanks ... View more