@Override
  public void preScannerOpen(ObserverContext<? extends RegionCoprocessorEnvironment> e, Scan scan)
    throws IOException {
    if (!initialized) {
      throw new VisibilityControllerNotReadyException("VisibilityController not yet initialized!");
    }
    // Nothing to do if authorization is not enabled
    if (!authorizationEnabled) {
      return;
    }
    Region region = e.getEnvironment().getRegion();
    Authorizations authorizations = null;
    try {
      authorizations = scan.getAuthorizations();
    } catch (DeserializationException de) {
      throw new IOException(de);
    }
    if (authorizations == null) {
      // No Authorizations present for this scan/Get!
      // In case of system tables other than "labels" just scan with out visibility check and
      // filtering. Checking visibility labels for META and NAMESPACE table is not needed.
      TableName table = region.getRegionInfo().getTable();
      if (table.isSystemTable() && !table.equals(LABELS_TABLE_NAME)) {
        return;
      }
    }

    Filter visibilityLabelFilter =
      VisibilityUtils.createVisibilityLabelFilter(region, authorizations);
    if (visibilityLabelFilter != null) {
      Filter filter = scan.getFilter();
      if (filter != null) {
        scan.setFilter(new FilterList(filter, visibilityLabelFilter));
      } else {
        scan.setFilter(visibilityLabelFilter);
      }
    }
  }
Checks whether cell contains any tag with type as VISIBILITY_TAG_TYPE. This tag type is
reserved and should not be explicitly set by user.
@param cell The cell under consideration
@param pair An optional pair of type {@code <Boolean, Tag>} which would be reused if already
            set and new one will be created if NULL is passed
@return If the boolean is false then it indicates that the cell has a RESERVERD_VIS_TAG and
        with boolean as true, not null tag indicates that a string modified tag was found.
hbase-server/src/main/java/org/apache/hadoop/hbase/security/visibility/VisibilityController.java