@Override
  public VisibilityExpEvaluator getVisibilityExpEvaluator(Authorizations authorizations)
    throws IOException {
    // If a super user issues a get/scan, he should be able to scan the cells
    // irrespective of the Visibility labels
    if (isReadFromSystemAuthUser()) {
      return new VisibilityExpEvaluator() {
        @Override
        public boolean evaluate(Cell cell) throws IOException {
          return true;
        }
      };
    }
    List<String> authLabels = null;
    for (ScanLabelGenerator scanLabelGenerator : scanLabelGenerators) {
      try {
        // null authorizations to be handled inside SLG impl.
        authLabels = scanLabelGenerator.getLabels(VisibilityUtils.getActiveUser(), authorizations);
        authLabels = (authLabels == null) ? new ArrayList<>() : authLabels;
        authorizations = new Authorizations(authLabels);
      } catch (Throwable t) {
        LOG.error(t.toString(), t);
        throw new IOException(t);
      }
    }
    int labelsCount = this.labelsCache.getLabelsCount();
    final BitSet bs = new BitSet(labelsCount + 1); // ordinal is index 1 based
    if (authLabels != null) {
      for (String authLabel : authLabels) {
        int labelOrdinal = this.labelsCache.getLabelOrdinal(authLabel);
        if (labelOrdinal != 0) {
          bs.set(labelOrdinal);
        }
      }
    }

    return new VisibilityExpEvaluator() {
      @Override
      public boolean evaluate(Cell cell) throws IOException {
        boolean visibilityTagPresent = false;
        assert cell instanceof ExtendedCell;
        Iterator<Tag> tagsItr = PrivateCellUtil.tagsIterator((ExtendedCell) cell);
        while (tagsItr.hasNext()) {
          boolean includeKV = true;
          Tag tag = tagsItr.next();
          if (tag.getType() == VISIBILITY_TAG_TYPE) {
            visibilityTagPresent = true;
            int offset = tag.getValueOffset();
            int endOffset = offset + tag.getValueLength();
            while (offset < endOffset) {
              Pair<Integer, Integer> result = TagUtil.readVIntValuePart(tag, offset);
              int currLabelOrdinal = result.getFirst();
              if (currLabelOrdinal < 0) {
                // check for the absence of this label in the Scan Auth labels
                // ie. to check BitSet corresponding bit is 0
                int temp = -currLabelOrdinal;
                if (bs.get(temp)) {
                  includeKV = false;
                  break;
                }
              } else {
                if (!bs.get(currLabelOrdinal)) {
                  includeKV = false;
                  break;
                }
              }
              offset += result.getSecond();
            }
            if (includeKV) {
              // We got one visibility expression getting evaluated to true. Good to include this
              // KV in the result then.
              return true;
            }
          }
        }
        return !(visibilityTagPresent);
      }
    };
  }
Adds the mutations to labels region and set the results to the finalOpStatus. finalOpStatus
might have some entries in it where the OpStatus is FAILURE. We will leave those and set in
others in the order.
@return whether we need a ZK update or not.
hbase-server/src/main/java/org/apache/hadoop/hbase/security/visibility/DefaultVisibilityLabelServiceImpl.java