Determining when virtual connections with data policies are architecturally preferable to per-workbook user filters for row-level security, weighing centralized governance against the query-time performance implications for extract-backed versus live connection scenarios