@Override
  public List<String> getLabels(User user, Authorizations authorizations) {
    String userName = user.getShortName();
    if (authorizations != null) {
      LOG.warn("Dropping authorizations requested by user " + userName + ": " + authorizations);
    }
    Set<String> auths = new HashSet<>();
    auths.addAll(this.labelsCache.getUserAuths(userName));
    auths.addAll(this.labelsCache.getGroupAuths(user.getGroupNames()));
    return new ArrayList<>(auths);
  }
This ScanLabelGenerator enforces a set of predefined authorizations for a given user, the set
defined by the admin using the VisibilityClient admin interface or the set_auths shell command.
Any authorizations requested with Scan#authorizations will be ignored.
hbase-server/src/main/java/org/apache/hadoop/hbase/security/visibility/EnforcingScanLabelGenerator.java