@Override
  public ReturnCode filterCell(final Cell cell) throws IOException {
    if (
      curFamily.getBytes() == null || !(PrivateCellUtil.matchingFamily(cell, curFamily.getBytes(),
        curFamily.getOffset(), curFamily.getLength()))
    ) {
      curFamily.set(cell.getFamilyArray(), cell.getFamilyOffset(), cell.getFamilyLength());
      // For this family, all the columns can have max of curFamilyMaxVersions versions. No need to
      // consider the older versions for visibility label check.
      // Ideally this should have been done at a lower layer by HBase (?)
      curFamilyMaxVersions = cfVsMaxVersions.get(curFamily);
      // Family is changed. Just unset curQualifier.
      curQualifier.unset();
    }
    if (
      curQualifier.getBytes() == null || !(PrivateCellUtil.matchingQualifier(cell,
        curQualifier.getBytes(), curQualifier.getOffset(), curQualifier.getLength()))
    ) {
      curQualifier.set(cell.getQualifierArray(), cell.getQualifierOffset(),
        cell.getQualifierLength());
      curQualMetVersions = 0;
    }
    curQualMetVersions++;
    if (curQualMetVersions > curFamilyMaxVersions) {
      return ReturnCode.SKIP;
    }

    return this.expEvaluator.evaluate(cell) ? ReturnCode.INCLUDE : ReturnCode.SKIP;
  }
This Filter checks the visibility expression with each KV against visibility labels associated
with the scan. Based on the check the KV is included in the scan result or gets filtered out.
hbase-server/src/main/java/org/apache/hadoop/hbase/security/visibility/VisibilityLabelFilter.java